[PR #3483] added rule: Brand impersonation: Microsoft Teams

Author: github-actions[bot]

detection-rules/3483_impersonation_microsoft_teams.yml

@@ -0,0 +1,63 @@
+name: "Brand impersonation: Microsoft Teams"
+description: |
+  Impersonation of a Microsoft Teams message.
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  and (
+    (
+      0 < length(filter(attachments,
+                        .file_type in $file_types_images or .file_type == "pdf"
+                 )
+      ) < 10
+    )
+    or (
+      length(filter(attachments,
+                    .file_extension == "ics" or .content_type == "text/calendar"
+             )
+      ) == 1
+    )
+  )
+  and any(attachments,
+          (
+            (.file_type in $file_types_images or .file_type == "pdf")
+            and any(file.explode(.),
+                    regex.icontains(.scan.ocr.raw,
+                                    "trying to reach you.*microsoft teams",
+                                    "microsoft teams.*meeting (recording|event)"
+                    )
+            )
+          )
+          or (
+            (.file_extension == "ics" or .content_type == "text/calendar")
+            and any(file.explode(.),
+                    regex.icontains(.scan.strings.raw,
+                                    "trying to reach you.*microsoft teams",
+                                    "microsoft teams.*meeting (recording|event)"
+                    )
+            )
+          )
+  )
+  and (
+    sender.email.domain.root_domain not in (
+      "microsoft.com",
+      "microsoftsupport.com",
+      "office.com"
+    )
+    or not sender.email.domain.valid
+  )
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Impersonation: Brand"
+  - "Social engineering"
+detection_methods:
+  - "Content analysis"
+  - "File analysis"
+  - "Optical Character Recognition"
+  - "Sender analysis"
+id: "3edd5da2-624b-5b03-9208-871f21790c47"
+og_id: "9cd53055-8e1a-5a45-b78f-34a62f0793dd"
+testing_pr: 3483
+testing_sha: 1b701f2cb215d34fce1036c192696359a0a91c6a