Create rule: Generic Financial Document Template#4498
Conversation
Detects messages with generic 'dear sir/madam' greetings that reference payment releases & timelines, contain links with suspicious hosting or open redirects, and exhibit unusual recipient patterns such as self-sending or missing recipients.
github-actions
Bot
added
the
in-test-rules
…and suspicious hosting template
…ncial document and suspicious hosting template
…ancial document and suspicious hosting template
|
Telemetry looks good. Low volume TTP but viable. 4 net new samps over L90D, good detection in depth. One observable - There is similar style rule that matches after a few changes, but only hits 2 of the 91 samps flagged in this PR over L90D, this PR does not lean on profiles, and is a very specific pattern. |
IndiaAce
left a comment
IndiaAce
left a comment
There was a problem hiding this comment.
Hey dude, the telemetry on this rule is crazy good in Mode! batting 1000 for malicious in the last 14 days. A few things I want to point out: I see in the latest batch of rules that almost all of them match existing rules, I'm super down for detection in-depth, especially when we are resolving FNs, but I wanted to see if you had considered modifying the existing Business Email Compromise (BEC) attempt from untrusted sender rule to account for this? Been looking through the hunts and I see that a good amount of these similar emails matching the BEC rule so just wanted to toss it out.
Also, I've been working on a suite of rules for that excessive padding in the body of the email and made a PR to modify that rule and the existing generic document sharing rule to catch this sample as well, so we've got good detection-in-depth coming for this. #4556
|
Gonna remove review-needed from this but feel free to shoot me a DM when you're ready for re-review for anything here! |
Thanks! Given it's growing hit count, I found it a viable candidate for surfacing based on campaign template structure. I compared |
…nancials_template
Few updates: - Removing starting check of strict greeting. - Updating undisclosed recipients to current standard.
…nt and suspicious hosting template
…financial document and suspicious hosting template
…inancial document and suspicious hosting template
Noticed FP's from removing greeting condition. Adding nlu with character limiter to negate FP's and FN's.
Wrong logic committed. This is the correct logic
|
Quick update: Adding nlu intent filter & simple character count to mitigate FP's & FN's introduced from removing greeting condition. - Hunt 1 (Shared samps) - New logic - L90D |
…financial document and suspicious hosting template
…nt and suspicious hosting template
…inancial document and suspicious hosting template
2 participants
Description
Detects messages with generic 'dear sir/madam' greetings that reference payment releases & timelines, contain links with suspicious hosting or open redirects, and exhibit unusual recipient patterns such as self-sending or missing recipients.
Associated samples
- Sample 1
Associated hunts
- Hunt 1 (Shared Samples)
- Hunt 2 (Multi-hunt)