Create attachment_xls_legal_disclaimer.yml

detection-rules/attachment_xls_legal_disclaimer.yml

@@ -0,0 +1,26 @@
+name: "Attachment: XLS with legal confidentiality disclaimer"
+description: "Detects inbound emails with XLS attachments containing a specific legal confidentiality disclaimer string commonly found in corporate email signatures. This pattern may indicate a malicious spreadsheet crafted to appear as a legitimate forwarded business communication, lending false credibility to the attachment."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and any(attachments,
+          (.file_extension in~ ("xls"))
+          and any(file.explode(.),
+                  any(.scan.strings.strings,
+                      strings.contains(.,
+                                       'The information contained in this transmission and its attachments (an "e-communication") are intended solely for the use of the intended recipient(s) and may contain information that is privileged, confidential, proprietary and/or otherwise protected by work product immunity or other legal rules.'
+                      )
+                  )
+          )
+  )
+attack_types:
+  - "Malware/Ransomware"
+  - "BEC/Fraud"
+tactics_and_techniques:
+  - "Social engineering"
+  - "Macros"
+detection_methods:
+  - "File analysis"
+  - "Content analysis"
+id: "f31995dd-f922-5954-a077-e74c3a3bc287"