sublimemediumRule

Link: Microsoft protected message with matching sender and recipient addresses

Detects when a user receives a protected message (RPMSG) with the to and from headers matching.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
// contains the rpmsg
and any(attachments,
        .file_extension == "rpmsg"
        or .content_type == "application/x-microsoft-rpmsg-message"
)
// contains the proper link
and any(body.links,
        .href_url.domain.root_domain == "office365.com"
        and (
          strings.icontains(.href_url.query_params, "InternetMessageID=")
          or strings.icontains(.href_url.path, '/Encryption/retrieve.ashx')
        )
)
// the To and From headers are the same
and length(recipients.to) == 1
and all(recipients.to, .email.email == sender.email.email)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Link: Microsoft protected message with matching sender and recipient addresses"
description: "Detects when a user receives a protected message (RPMSG) with the to and from headers matching."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // contains the rpmsg
  and any(attachments,
          .file_extension == "rpmsg"
          or .content_type == "application/x-microsoft-rpmsg-message"
  )
  // contains the proper link
  and any(body.links,
          .href_url.domain.root_domain == "office365.com"
          and (
            strings.icontains(.href_url.query_params, "InternetMessageID=")
            or strings.icontains(.href_url.path, '/Encryption/retrieve.ashx')
          )
  )
  // the To and From headers are the same
  and length(recipients.to) == 1
  and all(recipients.to, .email.email == sender.email.email)
tags:
 - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "File analysis"
  - "Header analysis"
  - "Sender analysis"
  - "URL analysis"
id: "a5a2f75d-88a2-5c19-9b83-fa55c2bd3ccf"