Refine detection rule for Canada Revenue Agency impersonation#4668
Refine detection rule for Canada Revenue Agency impersonation#4668cybher0808 wants to merge 1 commit into
Conversation
Updated the rule name to include 'CRA' for clarity and enhanced the NLU classification logic to include checks for sender entities and language detection.
cybher0808
added
the
in-test-rules
…n: Canada Revenue Agency (CRA)
|
Result look good, this is a quick add on from the last rule. Marking R4R. |
| or any(ml.nlu_classifier(body.current_thread.text).entities, | ||
| .name in ("sender", "org") | ||
| and .text in ('Canada Revenue Agency', 'Canada Revenue Agency (CRA)') | ||
| ) |
There was a problem hiding this comment.
This stanza appears to be designed to detect the "suspicious" part of an impersonation, the NLU sender/org logic seems to be a better match for the stanza above this one (// sender claims to be CRA)
| .name in ("sender", "org") | ||
| and .text in ('Canada Revenue Agency', 'Canada Revenue Agency (CRA)') | ||
| ) | ||
| or ml.nlu_classifier(body.current_thread.text).language == "french" |
There was a problem hiding this comment.
This appears to be a pretty broad "suspicious" element and given that french of spoken in some parts of Canada I suspect isn't a very strong indicator.
|
you might have better luck "flipping' the logic of this rule around and instead of trying to find/define "suspicious", define what different from the benign/legit samples. for example, I noticed that VERY few of the legit emails that are from Canada Revenue Agency have links in the body.current_thread and when it does, they are to known/legit domains (canada.ca) this hunt tests that (looks for messages from the high_trust/legit sender domain WITH links and returns 2 matches any message that appears to be from CRA and has links that don't go to canada.ca might be worth while. The other sample includes a PDF attachment, I found that the normal CRA emails contain only image attachments. here is a search of messages from CRA that can be used as references |
|
a net new hunt (over the current version of the rule) that implements some of my ideas |
2 participants
Description
Updating this rule with additional nlu classifications for
sender,organdlanguagedescriptionsAssociated samples
Associated hunts