From 63da8b365a299ee9ac8f32a5b4889305cf0d7067 Mon Sep 17 00:00:00 2001 From: Daniel Bolton Date: Tue, 8 Sep 2026 16:17:21 -0500 Subject: [PATCH 1/2] Create attachment_xls_legal_disclaimer.yml --- .../attachment_xls_legal_disclaimer.yml | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 detection-rules/attachment_xls_legal_disclaimer.yml diff --git a/detection-rules/attachment_xls_legal_disclaimer.yml b/detection-rules/attachment_xls_legal_disclaimer.yml new file mode 100644 index 00000000000..d964820fdde --- /dev/null +++ b/detection-rules/attachment_xls_legal_disclaimer.yml @@ -0,0 +1,24 @@ +name: "Attachment: XLS with legal confidentiality disclaimer" +description: "Detects inbound emails with XLS attachments containing a specific legal confidentiality disclaimer string commonly found in corporate email signatures. This pattern may indicate a malicious spreadsheet crafted to appear as a legitimate forwarded business communication, lending false credibility to the attachment." +type: "rule" +severity: "medium" +source: | + type.inbound + and any(attachments, + (.file_extension in~ ("xls")) + and any(file.explode(.), + any(.scan.strings.strings, + strings.contains(., 'The information contained in this transmission and its attachments (an "e-communication") are intended solely for the use of the intended recipient(s) and may contain information that is privileged, confidential, proprietary and/or otherwise protected by work product immunity or other legal rules.') + + ) + ) + ) +attack_types: + - "Malware/Ransomware" + - "BEC/Fraud" +tactics_and_techniques: + - "Social engineering" + - "Macros" +detection_methods: + - "File analysis" + - "Content analysis" \ No newline at end of file From 6b2cc328e12313ecc4a70b96d5106559e0c9a683 Mon Sep 17 00:00:00 2001 From: CI Bot Date: Tue, 8 Sep 2026 21:19:00 +0000 Subject: [PATCH 2/2] Auto-format MQL and add rule IDs --- detection-rules/attachment_xls_legal_disclaimer.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/detection-rules/attachment_xls_legal_disclaimer.yml b/detection-rules/attachment_xls_legal_disclaimer.yml index d964820fdde..fee7dc6520f 100644 --- a/detection-rules/attachment_xls_legal_disclaimer.yml +++ b/detection-rules/attachment_xls_legal_disclaimer.yml @@ -8,8 +8,9 @@ source: | (.file_extension in~ ("xls")) and any(file.explode(.), any(.scan.strings.strings, - strings.contains(., 'The information contained in this transmission and its attachments (an "e-communication") are intended solely for the use of the intended recipient(s) and may contain information that is privileged, confidential, proprietary and/or otherwise protected by work product immunity or other legal rules.') - + strings.contains(., + 'The information contained in this transmission and its attachments (an "e-communication") are intended solely for the use of the intended recipient(s) and may contain information that is privileged, confidential, proprietary and/or otherwise protected by work product immunity or other legal rules.' + ) ) ) ) @@ -21,4 +22,5 @@ tactics_and_techniques: - "Macros" detection_methods: - "File analysis" - - "Content analysis" \ No newline at end of file + - "Content analysis" +id: "f31995dd-f922-5954-a077-e74c3a3bc287"