Create svg_reference_free_file_hosting.yml

detection-rules/svg_reference_free_file_hosting.yml

@@ -0,0 +1,54 @@
+name: "SVG file reference with free file hosting from non-freemail sender"
+description: "Detects messages containing SVG file references in links, body text, subject, or sender display name, combined with links to free file hosting services from non-freemail domains where the linked domains don't match the sender's domain."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  // length of body links is greater than 0 and less than 10
+  and 0 < length(body.links) < 10
+
+  and length(body.previous_threads) == 0
+
+  // sender is not freemail
+  and sender.email.domain.root_domain not in $free_email_providers
+
+  // and no body links match the sender's domain
+  and all(body.links,
+          .href_url.domain.root_domain != sender.email.domain.root_domain
+  )
+  // .svg found either in the body links or in the body text, or in certain header fields (subject, display name)
+  and (
+    any(body.links, strings.ilike(.display_text, "*.svg*"))
+    or (strings.icontains(body.current_thread.text, ".svg"))
+    or any([subject.subject, sender.display_name], strings.icontains(., '.svg'))
+  )
+  // any body links are in $free_file_hosts
+  and any(body.links,
+          (
+            .href_url.domain.domain in $free_file_hosts
+            or .href_url.domain.root_domain in $free_file_hosts
+          )
+          // remove free_file_hosts used to host images as links
+          and not any($file_types_images,
+                      strings.iends_with(..href_url.url, strings.concat('.', .))
+          )
+  )
+  // some exclusions for internal emails 
+  and not (
+    strings.icontains(body.current_thread.text, "Modify my alert settings")
+    or strings.icontains(body.current_thread.text, "Requested resource")
+    or strings.icontains(body.current_thread.text, "against company policy")
+  )
+
+attack_types:
+  - "Credential Phishing"
+  - "Malware/Ransomware"
+tactics_and_techniques:
+  - "Free file host"
+  - "Evasion"
+detection_methods:
+  - "Content analysis"
+  - "Header analysis"
+  - "Sender analysis"
+  - "URL analysis"
+id: "13c1bb93-f4b8-5ba1-b49b-5783eda7dca0"