sublimehighRule

Brand impersonation: Microsoft logo image linking to free file host

Detects inline images that display a Microsoft logo and contain text, used as clickable links within the message body. The link behind the image redirects to a self-service site creation platform or free file hosting domain rather than a legitimate Microsoft or tenant domain, a common technique for disguising credential phishing or malware delivery links as trusted Microsoft branded content.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1204.002 T1486 T1598.003

initial-access

Detection Query

type.inbound
and any(map(filter(attachments,
                   .file_type in $file_types_images
                   and .content_disposition =~ "inline"
                   and any(ml.logo_detect(.).brands,
                           strings.istarts_with(.name, "Microsoft")
                           and .confidence == "high"
                   )
                   // big image
                   and beta.parse_exif(.).image_height > 96
                   and beta.parse_exif(.).image_width > 96
                   // and there is text on the image
                   and regex.icount(beta.ocr(.).text, '\w+\W') > 5
            ),
            .content_id
        ),
        // that image is used a a link in the body
        any(html.xpath(body.html, '//a[.//img[@src]]').nodes,
            strings.icontains(.raw, ..)
            and any(.links,
                    // the link goes to self_service for free_file_hosts
                    (
                      .href_url.domain.domain in $self_service_creation_platform_domains
                      or .href_url.domain.root_domain in $self_service_creation_platform_domains
                      or .href_url.domain.domain in $free_file_hosts
                      or .href_url.domain.root_domain in $free_file_hosts
                    )
                    // but not sharepoint
                    and not .href_url.domain.domain in $tenant_domains
            )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: Microsoft logo image linking to free file host"
description: "Detects inline images that display a Microsoft logo and contain text, used as clickable links within the message body. The link behind the image redirects to a self-service site creation platform or free file hosting domain rather than a legitimate Microsoft or tenant domain, a common technique for disguising credential phishing or malware delivery links as trusted Microsoft branded content."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(map(filter(attachments,
                     .file_type in $file_types_images
                     and .content_disposition =~ "inline"
                     and any(ml.logo_detect(.).brands,
                             strings.istarts_with(.name, "Microsoft")
                             and .confidence == "high"
                     )
                     // big image
                     and beta.parse_exif(.).image_height > 96
                     and beta.parse_exif(.).image_width > 96
                     // and there is text on the image
                     and regex.icount(beta.ocr(.).text, '\w+\W') > 5
              ),
              .content_id
          ),
          // that image is used a a link in the body
          any(html.xpath(body.html, '//a[.//img[@src]]').nodes,
              strings.icontains(.raw, ..)
              and any(.links,
                      // the link goes to self_service for free_file_hosts
                      (
                        .href_url.domain.domain in $self_service_creation_platform_domains
                        or .href_url.domain.root_domain in $self_service_creation_platform_domains
                        or .href_url.domain.domain in $free_file_hosts
                        or .href_url.domain.root_domain in $free_file_hosts
                      )
                      // but not sharepoint
                      and not .href_url.domain.domain in $tenant_domains
              )
          )
  )
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Image as content"
  - "Free file host"
  - "Social engineering"
detection_methods:
  - "Computer Vision"
  - "Optical Character Recognition"
  - "Exif analysis"
  - "HTML analysis"
  - "URL analysis"
id: "b929c2fc-6328-5314-ade2-16b8fb19b321"