From a79a425a3b28cb9483e055962ae66979072d0647 Mon Sep 17 00:00:00 2001 From: Sublime Rule Testing Bot Date: Fri, 22 Nov 2024 22:03:21 +0000 Subject: [PATCH] Sync from PR#2159 Create spam_google_group_invite.yml by @zoomequipd https://github.com/sublime-security/sublime-rules/pull/2159 Source SHA 88db12fe0e212220660632ddd9078eaafe7d091c Triggered by @zoomequipd --- detection-rules/spam_google_group_invite.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 detection-rules/spam_google_group_invite.yml diff --git a/detection-rules/spam_google_group_invite.yml b/detection-rules/spam_google_group_invite.yml new file mode 100644 index 00000000000..c3ce37a5653 --- /dev/null +++ b/detection-rules/spam_google_group_invite.yml @@ -0,0 +1,15 @@ +name: "Spam: Google Groups Invitations" +description: "Detects suspicious Google Groups invitations containing inappropriate content or suspicious patterns. The rule looks for invites from non-organizational domains that contain random alphanumeric strings, explicit keywords, or suspicious call-to-action phrases in the group names or descriptions." +type: "rule" +severity: "low" +source: "type.inbound\n// \n// Warning: This rule contains sexually explict keywords\n// \nand sender.email.email == \"noreply@groups.google.com\"\nand (\n strings.istarts_with(subject.subject, 'Invitation to join ')\n or strings.istarts_with(subject.subject, 'You have been added to ')\n)\n// the invite is not from an $org_domain user\nand not any($org_domains,\n strings.icontains(body.current_thread.text,\n strings.concat('@',\n .,\n ' invited you to join the '\n )\n )\n or strings.icontains(body.current_thread.text,\n strings.concat('@', ., ' added you to the ')\n )\n)\nand (\n // the group name contains 7 char sets at the start and end and must contain a number\n regex.icontains(subject.subject,\n '(?:added to|to join) [A-Z0-9]{6,7} .*(?:[[:^ascii:]]|[[:^alpha:]]) [A-Z0-9]{6,7}$'\n )\n // calls to action in the group name\n or regex.icontains(subject.subject,\n '(?:added to|to join) .*(join|(?:click|go|tap) here)'\n )\n // it contains an emoji in the group name\n or regex.icontains(subject.subject,\n '(?:added to|to join) .*[\\x{1F300}-\\x{1F5FF}\\x{1F600}-\\x{1F64F}\\x{1F680}-\\x{1F6FF}\\x{1F700}-\\x{1F77F}\\x{1F780}-\\x{1F7FF}\\x{1F900}-\\x{1F9FF}\\x{2600}-\\x{26FF}\\x{2700}-\\x{27BF}\\x{2300}-\\x{23FF}]'\n )\n or \n regex.icontains(body.current_thread.text, '(?:about this group|message from).*(?:sex|horny|cock|fuck|ass|pussy|dick|tits|cum).*https?://')\n)\n" +attack_types: + - "Spam" +tactics_and_techniques: + - "Free email provider" +detection_methods: + - "Content analysis" + - "Sender analysis" +id: "4e0bec29-be9c-526f-ad56-824b4d87f55d" +testing_pr: 2159 +testing_sha: 88db12fe0e212220660632ddd9078eaafe7d091c