Credential phishing: Hyper-linked image leading to free file host

name: "Credential phishing: Hyper-linked image leading to free file host"
description: "This rule detects messages with short or null bodies, where all attachments are images, and the image is hyperlinking to a free_file_host from an unsolicited and untrusted sender."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and length(body.links) > 0
  and 0 < length(attachments) < 8
  and all(attachments, .file_type in $file_types_images and .size > 2000)
  and any(body.links,
          // fingerprints of a hyperlinked image
          .display_text is null
          and .display_url.url is null
          and .href_url.domain.root_domain in $free_file_hosts
  )
  and (
    // body text is very short
    (
      0 <= (length(body.current_thread.text)) < 10
      or body.current_thread.text is null
    )
    or (
      length(body.current_thread.text) < 900
      // or body is most likely all warning banner (text contains the sender and common warning banner language)
      and (
        (
          strings.contains(body.current_thread.text, sender.email.email)
          and strings.contains(body.current_thread.text, 'caution')
        )
        or regex.icontains(body.current_thread.text,
                           "intended recipient's use only|external email|sent from outside|you don't often|confidential"
        )
      )
    )
  )
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and (
        any(distinct(headers.hops, .authentication_results.dmarc is not null),
            strings.ilike(.authentication_results.dmarc, "*fail")
        )
      )
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
  
  // not solicited or previously flagged malicious/spam
  and (
    not profile.by_sender().solicited
    or profile.by_sender().any_messages_malicious_or_spam
  )
  
  // negate legitimate canva emails
  and not (
    strings.contains(sender.display_name, "via Canva")
    and sender.email.domain.domain == "canva.com"
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*pass")
      )
    )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Free file host"
  - "Image as content"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Sender analysis"
  - "URL analysis"

id: "f5cb1eca-667c-5750-9f00-b2b79c684ab1"