sublimemediumRule

Service abuse: File sharing impersonation with external SharePoint links

Detects inbound messages claiming to share files or invite access, containing SharePoint or OneDrive links from external domains. The rule identifies suspicious sharing notifications where link display text matches the sender's name rather than a legitimate document name, indicating potential impersonation of legitimate file sharing services.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
and strings.ilike(subject.subject, "*shared*", "*invit*")
and strings.ilike(body.current_thread.text,
                  "*shared a file with you*",
                  "*shared with you*",
                  "*invited you to access a file*"
)
and not strings.ilike(body.current_thread.text, "invited you to edit")
and (
  any(filter(body.current_thread.links,
             .href_url.domain.domain not in $tenant_domains
             and (
               .href_url.domain.root_domain == "sharepoint.com"
               or .href_url.domain.root_domain == "1drv.ms"
               or (
                 .href_url.domain.root_domain == 'mimecastprotect.com'
                 and strings.icontains(.href_url.query_params,
                                       '.sharepoint.com'
                 )
               )
             )
             and .display_text != "Open"
      ),
      // check if the display_text exactly matches the sender's display name
      .display_text == sender.display_name
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Service abuse: File sharing impersonation with external SharePoint links"
description: "Detects inbound messages claiming to share files or invite access, containing SharePoint or OneDrive links from external domains. The rule identifies suspicious sharing notifications where link display text matches the sender's name rather than a legitimate document name, indicating potential impersonation of legitimate file sharing services."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and strings.ilike(subject.subject, "*shared*", "*invit*")
  and strings.ilike(body.current_thread.text,
                    "*shared a file with you*",
                    "*shared with you*",
                    "*invited you to access a file*"
  )
  and not strings.ilike(body.current_thread.text, "invited you to edit")
  and (
    any(filter(body.current_thread.links,
               .href_url.domain.domain not in $tenant_domains
               and (
                 .href_url.domain.root_domain == "sharepoint.com"
                 or .href_url.domain.root_domain == "1drv.ms"
                 or (
                   .href_url.domain.root_domain == 'mimecastprotect.com'
                   and strings.icontains(.href_url.query_params,
                                         '.sharepoint.com'
                   )
                 )
               )
               and .display_text != "Open"
        ),
        // check if the display_text exactly matches the sender's display name
        .display_text == sender.display_name
    )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "URL analysis"
  - "Sender analysis"
id: "729661f2-8c11-5e74-8c2b-c20448d66576"