Link: Microsoft protected message with suspicious recipient patterns

name: "Link: Microsoft protected message with suspicious recipient patterns"
description: "Detects when a user receives a protected message (RPMSG) with the to and from headers matching or there is no TO header at all. Benign matches are possible, sender exclusions can be used to avoid matching on senders which commonly use Microsoft protected messages with suspicious recipient patterns"
type: "rule"
severity: "medium"
source: |
  type.inbound
  // contains the rpmsg
  and any(attachments,
          .file_extension == "rpmsg"
          or .content_type == "application/x-microsoft-rpmsg-message"
  )
  // contains the proper link
  and any(body.links,
          .href_url.domain.root_domain == "office365.com"
          and (
            strings.icontains(.href_url.query_params, "InternetMessageID=")
            or strings.icontains(.href_url.path, '/Encryption/retrieve.ashx')
          )
  )
  and (
    // self sender 
    (
      length(recipients.to) == 1
      and recipients.to[0].email.email == sender.email.email
    )
    // no recipients at all
    or length(recipients.to) == 0
  )
false_positives:
  - "Some senders commonly send messages which match this behavior, sender exclusions should be used to avoid continued/repeat matching of benign messages"
tags:
 - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "File analysis"
  - "Header analysis"
  - "Sender analysis"
  - "URL analysis"
id: "a5a2f75d-88a2-5c19-9b83-fa55c2bd3ccf"