sublimemediumRule

SharePoint OTP for filename matching org name

Detects Microsoft One-Time Passcode (OTP) messages where the shared document’s filename matches the sending organization's name. This typically indicates the recipient has verified their email address and is about to access a SharePoint file. Matching the document name to the sender's org is a pattern observed in multi-stage credential phishing campaigns, where attackers use branded file names to increase credibility and lure users into interacting with malicious content.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
// Microsoft sender
and sender.email.domain.root_domain == "microsoft.com"
// message ID contains the proper format for OTP messeges
and (
  (
    strings.istarts_with(headers.message_id, '<OneTimePasscode-')
    and strings.iends_with(headers.message_id, '@odspnotify>')
  )
  // deal with Google thinking the message ID is "broke"
  or (
    strings.icontains(headers.message_id, 'SMTPIN_ADDED_BROKEN')
    and any(headers.hops,
            any(.fields,
                .name == "X-Google-Original-Message-ID"
                and strings.istarts_with(.value, '<OneTimePasscode-')
                and strings.iends_with(.value, '@odspnotify>')
            )
    )
  )
)
// make sure the body has the phrase we need to get the document name
and strings.icontains(body.current_thread.text,
                      'For security purposes, you must enter the code below to verify your account to access'
)
// extract the filename and org name from the body and see if they are equal
and any(regex.iextract(body.current_thread.text,
                       'For security purposes, you must enter the code below to verify your account to access (?P<doc_name>.*)\. The code will only work for.*This email is generated through (?P<org_name>.*)''s use of Microsoft 365\.'
        ),
        .named_groups["doc_name"] =~ .named_groups["org_name"]
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "SharePoint OTP for filename matching org name"
description: "Detects Microsoft One-Time Passcode (OTP) messages where the shared document’s filename matches the sending organization's name. This typically indicates the recipient has verified their email address and is about to access a SharePoint file. Matching the document name to the sender's org is a pattern observed in multi-stage credential phishing campaigns, where attackers use branded file names to increase credibility and lure users into interacting with malicious content."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // Microsoft sender
  and sender.email.domain.root_domain == "microsoft.com"
  // message ID contains the proper format for OTP messeges
  and (
    (
      strings.istarts_with(headers.message_id, '<OneTimePasscode-')
      and strings.iends_with(headers.message_id, '@odspnotify>')
    )
    // deal with Google thinking the message ID is "broke"
    or (
      strings.icontains(headers.message_id, 'SMTPIN_ADDED_BROKEN')
      and any(headers.hops,
              any(.fields,
                  .name == "X-Google-Original-Message-ID"
                  and strings.istarts_with(.value, '<OneTimePasscode-')
                  and strings.iends_with(.value, '@odspnotify>')
              )
      )
    )
  )
  // make sure the body has the phrase we need to get the document name
  and strings.icontains(body.current_thread.text,
                        'For security purposes, you must enter the code below to verify your account to access'
  )
  // extract the filename and org name from the body and see if they are equal
  and any(regex.iextract(body.current_thread.text,
                         'For security purposes, you must enter the code below to verify your account to access (?P<doc_name>.*)\. The code will only work for.*This email is generated through (?P<org_name>.*)''s use of Microsoft 365\.'
          ),
          .named_groups["doc_name"] =~ .named_groups["org_name"]
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Header analysis"
id: "89911cbd-8865-5781-be99-04aa28660c0c"