Sync from PR#1001

New Rule: Credential Phishing: Fake Password Expiration by @morriscode
#1001
Source SHA 34a9761
Triggered by @morriscode

credential_phishing_fake_password_expiration.yml

@@ -0,0 +1,15 @@
+name: "Credential Phishing: Fake Password Expiration from New and Unsolicited sender"
+description: "This rule looks for password expiration verbiage in the subject and body. It requires between 1 and 9 links in the body. The rule uses NLU in addition to statically specified term anchors. High trust senders are also negated."
+type: "rule"
+severity: "medium"
+source: "type.inbound\n\n// no attachments\nand length(attachments) == 0\n\n// body contains expire, expiration, loose, lose \nand regex.icontains(body.current_thread.text, '(expir(e)?ation|lo(o)?se)')\n\n// subject or body contains account or access\nand any([subject.subject, body.current_thread.text],\n        regex.icontains(body.current_thread.text, \"account|access\")\n)\n\n// subject or body must contains password\nand any([subject.subject, body.current_thread.text],\n        regex.icontains(body.current_thread.text, '\\bpassword\\b')\n)\nand any(ml.nlu_classifier(body.current_thread.text).intents,\n        .name == \"cred_theft\" and .confidence == \"high\"\n)\n\n// sender is new and unsolicited and no previous malicious or spam flaggs\nand (\n  (\n    profile.by_sender().prevalence in (\"new\", \"outlier\")\n    and not profile.by_sender().solicited\n  )\n  or profile.by_sender().any_messages_malicious_or_spam\n)\n\n// no false positives\nand not profile.by_sender().any_false_positives\n\n// negate highly trusted sender domains unless they fail DMARC authentication\nand (\n  (\n    sender.email.domain.root_domain in $high_trust_sender_root_domains\n    and (\n      any(distinct(headers.hops, .authentication_results.dmarc is not null),\n          strings.ilike(.authentication_results.dmarc, \"*fail\")\n      )\n    )\n  )\n  or sender.email.domain.root_domain not in $high_trust_sender_root_domains\n)\n\n// body length between 600 and 2000\nand 600 < length(body.current_thread.text) < 2000\n\n// not a reply\nand (\n  length(headers.references) == 0\n  or not any(headers.hops, any(.fields, strings.ilike(.name, \"In-Reply-To\")))\n)\n"
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Social engineering"
+detection_methods:
+  - "Content analysis"
+  - "Natural Language Understanding"
+  - "Sender analysis"
+testing_pr: 1001
+testing_sha: 34a976130fb2d849382978ac483e664ebefe7dfd