diff --git a/insights/headers/phishing_simulation_adaptive_security.yml b/insights/headers/phishing_simulation_adaptive_security.yml new file mode 100644 index 00000000000..3a4f5bf9837 --- /dev/null +++ b/insights/headers/phishing_simulation_adaptive_security.yml @@ -0,0 +1,28 @@ +name: "Adaptive Security phishing simulation" +type: "query" +source: | + type.inbound + and any(headers.hops, + any(.fields, + (.name == "X-Adaptive-Bypass" and .value == "adaptive") + or .name =~ "X-Adaptive-Campaign-Id" + ) + ) + and sender.email.domain.root_domain in ( + "confirm-login.com", + "loginupdate.com", + "resetusername.com", + "logindirect.net", + "secureaccount.net", + "secureaccounts.net", + "resetpassword.io", + "secureaccounts.org", + "updateaccount.co", + "verifylogin.co", + "protect-sys.com", + "sys-info-net.com" + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_arctic_wolf_msa.yml b/insights/headers/phishing_simulation_arctic_wolf_msa.yml new file mode 100644 index 00000000000..6879889d7a7 --- /dev/null +++ b/insights/headers/phishing_simulation_arctic_wolf_msa.yml @@ -0,0 +1,54 @@ +name: "Arctic Wolf MSA phishing simulation" +type: "query" +source: | + type.inbound + // Arctic Wolf MSA sends from shared SendGrid infrastructure, so the IP set + // alone is not specific; it must be paired with an Arctic Wolf campaign domain. + and any(headers.ips, + .ip in ( + "149.72.89.230", + "149.72.154.143", + "149.72.233.38", + "149.72.61.155" + ) + ) + and ( + sender.email.domain.root_domain in ( + "arcticwolfawareness.com", + "arcticwolf.com", + "automated-mailsender.com", + "corporate-alert.com", + "helpdesk-itsupport.com", + "humanresources-mailer.com", + "internal-humanresources.com", + "internalcorporate-mailer.com", + "mail-donotreply.com", + "securityalert-corporate.com", + "admin-hinweis.de", + "itsupport-mitarbeiter.de", + "mitarbeiter-helpdesk.de", + "unternehmenssicherheit-alarm.de" + ) + or any(body.links, + .href_url.domain.root_domain in ( + "arcticwolfawareness.com", + "arcticwolf.com", + "automated-mailsender.com", + "corporate-alert.com", + "helpdesk-itsupport.com", + "humanresources-mailer.com", + "internal-humanresources.com", + "internalcorporate-mailer.com", + "mail-donotreply.com", + "securityalert-corporate.com", + "admin-hinweis.de", + "itsupport-mitarbeiter.de", + "mitarbeiter-helpdesk.de", + "unternehmenssicherheit-alarm.de" + ) + ) + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_breach_secure_now.yml b/insights/headers/phishing_simulation_breach_secure_now.yml new file mode 100644 index 00000000000..d0055658bf2 --- /dev/null +++ b/insights/headers/phishing_simulation_breach_secure_now.yml @@ -0,0 +1,49 @@ +name: "Breach Secure Now phishing simulation" +type: "query" +source: | + type.inbound + and any(headers.ips, + .ip in ( + "149.72.207.249", + "168.245.40.98", + "149.72.184.111", + "168.245.30.20", + "54.209.51.230", + "18.209.119.19", + "34.231.173.178", + "168.245.68.173", + "168.245.34.162" + ) + ) + and sender.email.domain.root_domain in ( + "it-support.care", + "customer-portal.info", + "member-services.info", + "bankonlinesupport.com", + "secureaccess.biz", + "logineverification.com", + "iogmein.com", + "mlcrosoft.live", + "cloud-service-care.com", + "packagetrackingportal.com" + ) + and any(headers.hops, any(.fields, .name =~ "X-SN-EMAIL-PHISHING")) + // every non-mailto link must point at a Breach Secure Now simulation domain + and all(filter(body.links, .href_url.scheme != "mailto"), + .href_url.domain.root_domain in ( + "it-support.care", + "customer-portal.info", + "member-services.info", + "bankonlinesupport.com", + "secureaccess.biz", + "logineverification.com", + "iogmein.com", + "mlcrosoft.live", + "cloud-service-care.com", + "packagetrackingportal.com" + ) + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_bullphish.yml b/insights/headers/phishing_simulation_bullphish.yml new file mode 100644 index 00000000000..473ae0ca29a --- /dev/null +++ b/insights/headers/phishing_simulation_bullphish.yml @@ -0,0 +1,11 @@ +name: "BullPhish ID phishing simulation" +type: "query" +source: | + type.inbound + and headers.mailer == "Bullphish" + and any(headers.domains, .root_domain == "bullphish.com") + and any(headers.ips, .ip == "34.237.252.20") +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_caniphish.yml b/insights/headers/phishing_simulation_caniphish.yml new file mode 100644 index 00000000000..64ddb312458 --- /dev/null +++ b/insights/headers/phishing_simulation_caniphish.yml @@ -0,0 +1,31 @@ +name: "CanIPhish phishing simulation" +type: "query" +source: | + type.inbound + // CanIPhish stamps a dedicated header on every simulation (value is the + // per-tenant ID, so match on the header name). White-labeled tenants keep + // the header even when the sending domains are customized. + and any(headers.hops, any(.fields, .name =~ "X-CanIPhish")) + and ( + any(headers.ips, .ip in ("3.106.21.22", "13.237.47.221")) + or sender.email.domain.root_domain in ( + "alerting-services.com", + "authwebmail.com", + "cloud-notification-services.com", + "securesupportcloud.com", + "office-365-notifications.com", + "webnotifications.net", + "paypaypal.net", + "cmail31.com", + "authenticationsecure.com", + "verificationweb.net", + "onlineverify.net", + "portal-login.net", + "email-forwarder.net", + "caniphish.com" + ) + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_fable.yml b/insights/headers/phishing_simulation_fable.yml new file mode 100644 index 00000000000..01a47778edb --- /dev/null +++ b/insights/headers/phishing_simulation_fable.yml @@ -0,0 +1,13 @@ +name: "Fable Security phishing simulation" +type: "query" +source: | + type.inbound + and any(headers.ips, .ip in ("50.31.205.248", "159.183.27.69")) + and any(headers.hops, + any(.fields, .name =~ "X-Fable-Phishing-Simulation" and .value == "1") + ) + and headers.auth_summary.dmarc.pass +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_huntress.yml b/insights/headers/phishing_simulation_huntress.yml new file mode 100644 index 00000000000..2ab28749f29 --- /dev/null +++ b/insights/headers/phishing_simulation_huntress.yml @@ -0,0 +1,64 @@ +name: "Huntress phishing simulation" +type: "query" +source: | + type.inbound + and ( + // SMTP delivery (single /32, equivalent to the exclusion's beta.ip_in) + any(headers.ips, .ip == "18.205.140.116") + // MS/Gmail DMI + or length(headers.hops) == 1 + ) + and any(headers.hops, any(.fields, .name =~ "X-PHISHTEST-Curricula")) + and any(headers.hops, + any(.fields, .name in~ ('X-C-Message-Id', 'C-Message-Id')) + ) + and sender.email.domain.root_domain in ( + "securitynotifications.org", + "security-updater.com", + "amazonsecurity.org", + "breach-notice.com", + "filesharingnow.com", + "mailbox-quota.com", + "passwordsnotification.com", + "securelinkedin.com", + "fraud-assistance.com", + "payment-process.com", + "news-article.com", + "invite-meeting.com", + "feedback-collect.com", + "businessnotice.org", + "databoxonline.com", + "electronic-hr.com", + "emailtransaction.com", + "employee-services.org", + "governmentnotice.org", + "notificationservices.org", + ) + and any(body.links, + .href_url.domain.root_domain in ( + "securitynotifications.org", + "security-updater.com", + "amazonsecurity.org", + "breach-notice.com", + "filesharingnow.com", + "mailbox-quota.com", + "passwordsnotification.com", + "securelinkedin.com", + "fraud-assistance.com", + "payment-process.com", + "news-article.com", + "invite-meeting.com", + "feedback-collect.com", + "businessnotice.org", + "databoxonline.com", + "electronic-hr.com", + "emailtransaction.com", + "employee-services.org", + "governmentnotice.org", + "notificationservices.org", + ) + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_infoseciq.yml b/insights/headers/phishing_simulation_infoseciq.yml new file mode 100644 index 00000000000..1a1e42fe436 --- /dev/null +++ b/insights/headers/phishing_simulation_infoseciq.yml @@ -0,0 +1,10 @@ +name: "Infosec IQ phishing simulation" +type: "query" +source: | + type.inbound + and any(headers.ips, .ip in ("52.1.22.105", "34.202.49.109")) + and any(headers.domains, .domain == "securityiq.infosecinstitute.com") +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_material.yml b/insights/headers/phishing_simulation_material.yml new file mode 100644 index 00000000000..0565b8c9a92 --- /dev/null +++ b/insights/headers/phishing_simulation_material.yml @@ -0,0 +1,10 @@ +name: "Material phishing simulation" +type: "query" +source: | + type.inbound + and length(headers.hops) == 1 + and strings.ends_with(headers.message_id, "material.security>") +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_microsoft.yml b/insights/headers/phishing_simulation_microsoft.yml new file mode 100644 index 00000000000..b5862bd7d33 --- /dev/null +++ b/insights/headers/phishing_simulation_microsoft.yml @@ -0,0 +1,280 @@ +name: "Microsoft Defender Attack phishing simulation" +type: "query" +source: | + type.inbound + and length(headers.hops) == 1 + and ( + ( + length(body.links) > 0 + and any(body.links, + .href_url.domain.root_domain in ( + "attemplate.com", + "bankmenia.com", + "bankmenia.de", + "bankmenia.es", + "bankmenia.fr", + "bankmenia.it", + "bankmenia.org", + "banknown.de", + "banknown.es", + "banknown.fr", + "banknown.it", + "banknown.org", + "browsersch.com", + "browsersch.de", + "browsersch.es", + "browsersch.fr", + "browsersch.it", + "browsersch.org", + "docdeliveryapp.com", + "docdeliveryapp.net", + "docstoreinternal.com", + "docstoreinternal.net", + "doctorican.de", + "doctorican.es", + "doctorican.fr", + "doctorican.it", + "doctorican.org", + "doctrical.com", + "doctrical.de", + "doctrical.es", + "doctrical.fr", + "doctrical.it", + "doctrical.org", + "doctricant.com", + "doctrings.com", + "doctrings.de", + "doctrings.es", + "doctrings.fr", + "doctrings.it", + "doctrings.org", + "exportants.com", + "exportants.de", + "exportants.es", + "exportants.fr", + "exportants.it", + "exportants.org", + "financerta.com", + "financerta.de", + "financerta.es", + "financerta.fr", + "financerta.it", + "financerta.org", + "financerts.com", + "financerts.de", + "financerts.es", + "financerts.fr", + "financerts.it", + "financerts.org", + "hardwarecheck.net", + "hrsupportint.com", + "mcsharepoint.com", + "mesharepoint.com", + "officence.com", + "officenced.com", + "officences.com", + "officentry.com", + "officested.com", + "passwordle.de", + "passwordle.fr", + "passwordle.it", + "passwordle.org", + "payrolltooling.com", + "payrolltooling.net", + "prizeably.com", + "prizeably.de", + "prizeably.es", + "prizeably.fr", + "prizeably.it", + "prizeably.org", + "prizegiveaway.net", + "prizegives.com", + "prizemons.com", + "prizesforall.com", + "prizewel.com", + "prizewings.com", + "resetts.de", + "resetts.es", + "resetts.fr", + "resetts.it", + "resetts.org", + "salarytoolint.com", + "salarytoolint.net", + "securembly.com", + "securembly.de", + "securembly.es", + "securembly.fr", + "securembly.it", + "securembly.org", + "securetta.de", + "securetta.es", + "securetta.fr", + "securetta.it", + "shareholds.com", + "sharepointen.com", + "sharepointin.com", + "sharepointle.com", + "sharesbyte.com", + "sharession.com", + "sharestion.com", + "supportin.de", + "supportin.es", + "supportin.fr", + "supportin.it", + "supportres.de", + "supportres.es", + "supportres.fr", + "supportres.it", + "supportres.org", + "techidal.com", + "techidal.de", + "techidal.fr", + "techidal.it", + "techniel.de", + "techniel.es", + "techniel.fr", + "techniel.it", + "templateau.com", + "templatent.com", + "templatern.com", + "windocyte.com" + ) + ) + ) + or sender.email.domain.domain in ( + "attemplate.com", + "bankmenia.com", + "bankmenia.de", + "bankmenia.es", + "bankmenia.fr", + "bankmenia.it", + "bankmenia.org", + "banknown.de", + "banknown.es", + "banknown.fr", + "banknown.it", + "banknown.org", + "browsersch.com", + "browsersch.de", + "browsersch.es", + "browsersch.fr", + "browsersch.it", + "browsersch.org", + "docdeliveryapp.com", + "docdeliveryapp.net", + "docstoreinternal.com", + "docstoreinternal.net", + "doctorican.de", + "doctorican.es", + "doctorican.fr", + "doctorican.it", + "doctorican.org", + "doctrical.com", + "doctrical.de", + "doctrical.es", + "doctrical.fr", + "doctrical.it", + "doctrical.org", + "doctricant.com", + "doctrings.com", + "doctrings.de", + "doctrings.es", + "doctrings.fr", + "doctrings.it", + "doctrings.org", + "exportants.com", + "exportants.de", + "exportants.es", + "exportants.fr", + "exportants.it", + "exportants.org", + "financerta.com", + "financerta.de", + "financerta.es", + "financerta.fr", + "financerta.it", + "financerta.org", + "financerts.com", + "financerts.de", + "financerts.es", + "financerts.fr", + "financerts.it", + "financerts.org", + "hardwarecheck.net", + "hrsupportint.com", + "mcsharepoint.com", + "mesharepoint.com", + "officence.com", + "officenced.com", + "officences.com", + "officentry.com", + "officested.com", + "passwordle.de", + "passwordle.fr", + "passwordle.it", + "passwordle.org", + "payrolltooling.com", + "payrolltooling.net", + "prizeably.com", + "prizeably.de", + "prizeably.es", + "prizeably.fr", + "prizeably.it", + "prizeably.org", + "prizegiveaway.net", + "prizegives.com", + "prizemons.com", + "prizesforall.com", + "prizewel.com", + "prizewings.com", + "resetts.de", + "resetts.es", + "resetts.fr", + "resetts.it", + "resetts.org", + "salarytoolint.com", + "salarytoolint.net", + "securembly.com", + "securembly.de", + "securembly.es", + "securembly.fr", + "securembly.it", + "securembly.org", + "securetta.de", + "securetta.es", + "securetta.fr", + "securetta.it", + "shareholds.com", + "sharepointen.com", + "sharepointin.com", + "sharepointle.com", + "sharesbyte.com", + "sharession.com", + "sharestion.com", + "supportin.de", + "supportin.es", + "supportin.fr", + "supportin.it", + "supportres.de", + "supportres.es", + "supportres.fr", + "supportres.it", + "supportres.org", + "techidal.com", + "techidal.de", + "techidal.fr", + "techidal.it", + "techniel.de", + "techniel.es", + "techniel.fr", + "techniel.it", + "templateau.com", + "templatent.com", + "templatern.com", + "windocyte.com" + ) + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_mimecast.yml b/insights/headers/phishing_simulation_mimecast.yml new file mode 100644 index 00000000000..8436692cb68 --- /dev/null +++ b/insights/headers/phishing_simulation_mimecast.yml @@ -0,0 +1,48 @@ +name: "Mimecast phishing simulation" +type: "query" +source: | + type.inbound + and sender.email.domain.root_domain in ( + // Engage Phishing Campaigns + "therelaysvc.com", + "therelayservice.com", + "securityvault.com", + "relaysvc.com", + // Engage Phishing Campaign Simulations + "accountsecuritynotices.com", + "benefits-bulletin.com", + "instant-promos.com", + "our-account.com", + "payroll-news.com", + "secure-corporate-communications.com", + "worldwidenewsupdates.com", + "info-needed.com", + // Awareness Training Phishing Campaign Simulations + "corporate-payroll.com", + "corp-news.com", + "corp-accounts.com", + "security-bulletin.com", + "secureceocommunications.com", + "salary-info.com", + "account-renewals.com", + "employee-news.com", + "secure-corporate-updates.com", + "securesecuritysolutions.com", + "subscriptionrenewalservices.com", + "sysgen-payroll.com", + "sysgen-cash.com", + "ceo-update.com", + "company-updates.com", + "corp-update.com", + "corporate-updates.com", + "cy-se.com", + "payroll-updates.com", + "secure-corporate-news.com", + "subscriptionrenewalnotices.com" + ) + // require SPF to pass so the simulation domains cannot be spoofed by a real attacker + and headers.auth_summary.spf.pass +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_ninjio.yml b/insights/headers/phishing_simulation_ninjio.yml new file mode 100644 index 00000000000..923ca2eba66 --- /dev/null +++ b/insights/headers/phishing_simulation_ninjio.yml @@ -0,0 +1,25 @@ +name: "NINJIO phishing simulation" +type: "query" +source: | + type.inbound + and any(headers.ips, .ip in ("168.245.68.235", "69.72.33.74", "198.244.55.48")) + and sender.email.domain.root_domain in ( + "securegateway-access.com", + "secure-scores.co", + "secure-paymentlink-auth.com", + "passlink-secure.com", + "net-link-secure.com", + "mypasschange.com", + "mycartcheck-out.com", + "media-sharer.com", + "ez-sendfile.net", + "encryptiaportal.net", + "drive-signin.org", + "csatsafety-training.org", + "cybersecurityawarenesstraining.com", + "myportalonline.org" + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_phish_notify.yml b/insights/headers/phishing_simulation_phish_notify.yml new file mode 100644 index 00000000000..cc569c71ccb --- /dev/null +++ b/insights/headers/phishing_simulation_phish_notify.yml @@ -0,0 +1,36 @@ +name: "Phish Notify phishing simulation" +type: "query" +source: | + type.inbound + // anchor on the Phish Notify campaign header so a bare sender/domain match can't FP + and any(headers.hops, any(.fields, .name =~ "X-Phish")) + and ( + any(headers.ips, + .ip in ( + "69.32.224.120", + "69.32.224.121", + "69.32.224.122", + "69.32.224.123", + "54.240.57.47", + "54.240.57.46", + "159.135.238.30" + ) + ) + or any(headers.hops, + any(.fields, + .name == "Received" + and regex.icontains(.value, + 'mail5\.infosecmail\.net', + 'mail6\.infosecmail\.net', + 'mail7\.infosecmail\.net', + 'mail8\.infosecmail\.net', + 'a57-46\.smtp-out\.us-west-2\.amazonses\.com', + 'a57-47\.smtp-out\.us-west-2\.amazonses\.com' + ) + ) + ) + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_phished.yml b/insights/headers/phishing_simulation_phished.yml new file mode 100644 index 00000000000..1c599b1a17b --- /dev/null +++ b/insights/headers/phishing_simulation_phished.yml @@ -0,0 +1,30 @@ +name: "Phished phishing simulation" +type: "query" +source: | + type.inbound + // Phished stamps campaign headers (names are constant; numeric values are + // per-tenant/recipient, so match on the header name). X-PHISHTEST-INFO + // additionally carries a constant identifying string. + and ( + any(headers.hops, + any(.fields, + .name in~ ("X-PHISHED-OrganisationID", "X-PHISHED-RecipientID") + ) + ) + or any(headers.hops, + any(.fields, + .name =~ "X-PHISHTEST-INFO" + and strings.icontains(.value, "phishing program of Phished") + ) + ) + ) + // confirm Phished sending infrastructure (custom return path psr.phished.io, + // or the SendGrid IPs Phished sends from) + and ( + headers.return_path.domain.root_domain == "phished.io" + or any(headers.ips, .ip in ("167.89.25.73", "149.72.177.106")) + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_proofpoint.yml b/insights/headers/phishing_simulation_proofpoint.yml new file mode 100644 index 00000000000..6092f138b96 --- /dev/null +++ b/insights/headers/phishing_simulation_proofpoint.yml @@ -0,0 +1,482 @@ +name: "Proofpoint Security Awareness phishing simulation" +type: "query" +source: | + type.inbound + and ( + ( + any(headers.hops, + any(.fields, .name == "X-ThreatSim-ID") + and any(headers.hops, + .index == 0 + and strings.contains(.received.server.raw, "threatsim.com") + ) + ) + ) + or ( + any(headers.ips, .ip in ("107.23.16.222", "54.173.83.138")) + and sender.email.domain.root_domain in ( + "4ooi.co", + "4ooi.com", + "4ooi.in", + "4ooi.info", + "account-maintenance.com", + "accounts-receivable.co", + "acct-payable.online", + "acct-receivable.co", + "acct-receivable.online", + "ackisses53.com", + "acxx53.com", + "acxx53.de", + "admissionshelpu.org", + "adobe-0nline.com", + "adobecloudservices.com", + "adobee.cloud", + "aibabba-deals.com", + "alibeba.info", + "amazon-site.io", + "amazoon.online", + "amezon.me", + "annualenroll.com", + "securityeducation.com", + "bank-site.co", + "banking24.club", + "breaking-news-network.net", + "breaking-news-now.com", + "business-services.org", + "byt.im", + "cadeauavant.fr", + "cardservices.online", + "cloud-store.services", + "combase.co", + "Committee4StrongLeadership.com", + "concur-s0lutions.com", + "contract-sign.online", + "corp-internal.co.uk", + "corp-internal.com", + "corp-internal.net", + "corp-internal.us", + "corp-proxy.com", + "corpbenefitplan.com", + "corpinternal.us", + "corpoutlook.com", + "creditmass.ru", + "cyber-sale.net", + "dcscanscation.com", + "debt-collections.pro", + "decision2016.win", + "detailswire.com", + "dhlsite.org", + "docsign-online.com", + "docusign-site.cloud", + "donatesolutions.net", + "donation-center.org", + "dropboxlink.com", + "dynssi.com", + "e-sale.live", + "e-servce.com", + "educationresource.site", + "ee77red.ru", + "egencia-online.com", + "electioninfo.online", + "electionsdecision.com", + "emailquarantine.com", + "enegry.org", + "entwurf-laden.de", + "event-planer.net", + "exch01-corp.com", + "firstfedtrust.com", + "flightstatalert.com", + "freeenergypress.com", + "fundingsource.services", + "gift-club.us", + "gmail-site.com", + "goggl.cc", + "googli.us", + "gotwebinar.online", + "gov-online.net", + "gov-services.com", + "greetingsweb.com", + "grnail.world", + "health-line.us", + "healthline.site", + "hpdocument.com", + "hr-dept.info", + "info-week.net", + "info-week.us", + "InformedVoterLeague.com", + "internalhr.online", + "internalitsupport.com", + "investmentsecureportal.com", + "itnues.net", + "lesportsacxx53.com", + "link91.in", + "linkedincdn.com", + "loan-payments.com", + "localhostlocaldomain.com", + "mail-center-alert.com", + "mail-delivery-system.com", + "maildeliverysystem.net", + "matchesonline.net", + "medical-site.site", + "metflix.us", + "micrasoft-office365.com", + "microsoftsql.net", + "myensurance.co", + "netbenefits-access.com", + "office-site.co", + "office3889.com", + "olympicresults.online", + "onlinedocshare.com", + "password-update.com", + "payablaccounts.com", + "payment-center.live", + "pharmamedsonline.com", + "pharmlink.in", + "pipelinenews.net", + "postcardfast.com", + "publicemailservice.com", + "qqoffi55.cc", + "qquio.com", + "register-now.world", + "sale-shop.club", + "sales-online.blog", + "scandeviceservices.com", + "sec-10k.com", + "securelogin-wallet.com", + "self-serve.co", + "sharepoint-docshare.com", + "shipment-confirm.com", + "shippingtracker.info", + "shippingupdate.net", + "sn84229.co", + "sphotos-fbcdn.com", + "techsupport-corp.com", + "thedisasterrelief.com", + "trackingupdate.net", + "tradeinternationai.com", + "updamicrosoft.com", + "updatracking.com", + "user-account.online", + "vobamobile.net", + "webfilteralert.com", + "www01-local.com", + "maliciousfile.online", + "meeting-reminder.com", + "micrasoft.ca", + "NationalCouncil4not-for-profits.com", + "office-site.store", + "onedrive-micrasoft.com", + "password-update.net", + "paypol-login.com", + "phishingtraining.com", + "prnewsnet.us", + "qqoffi55.com", + "rwebfix.com", + "salesteamlink.com", + "securebankingsevices.com", + "seriouslydonotclickthis.com", + "shippingtracker.co", + "shopingnow.net", + "stubclub.co", + "thisisaphishingattack.com", + "travelresinfo.com", + "user-account-maintenance.com", + "voicemailaccess.net" + ) + ) + or ( + any(headers.ips, .ip in ("52.17.45.98", "52.16.190.81")) + and sender.email.domain.root_domain in ( + "4ooi.co.uk", + "4ooi.net", + "accounts-receivable.online", + "accountsmaintenance.com", + "acct-payable.pro", + "acct-receivable.info", + "acct-receivable.org", + "admissionshelpu.com", + "adobe-0nline.net", + "adobedocuments.com", + "adobee.org", + "aibaba-deals.com", + "alibeba.store", + "amazon-site.live", + "amazoon.site", + "amezon.cloud", + "annualenroll.net", + "securityeducation.com", + "bancaire.co.uk", + "bancaire.org", + "bank-site.net", + "banking24.io", + "beingthebestU.com", + "bizsolutions-int.co.uk", + "bizsolutions-int.com", + "breaking-news-network.co.uk", + "breaking-news-now.net", + "business-services.site", + "c0ncursolutions.com", + "cardservices.vip", + "citydiscounts.org", + "cloud-store.space", + "coffeetooyourdesk.com", + "combase.io", + "Committee4StrongLeadership.org", + "contract-sign.site", + "corp-internal.co", + "corp-password-mangemet.com", + "corp-password-mangemet.fr", + "corp-password-mangemet.us", + "corpbenefitplan.net", + "corpoutlook.co.uk", + "cyber-sale.com", + "dcscanscation.net", + "debt-collections.online", + "decision2016.online", + "detailswire.net", + "dhlsite.net", + "docs-sharepoint.com", + "docsign-online.net", + "docusign-site.io", + "dodgylink.co.uk", + "domainte.com", + "donatesolutions.live", + "donation-center.pro", + "dropboxlink.net", + "dynssi.net", + "e-sale.io", + "e-servce.biz", + "eatandreward.com", + "educationresource.store", + "egencia-website.com", + "electioninfo.news", + "electionsdecision.net", + "emaildistro.net", + "emailquarantine.net", + "enegry.info", + "entwurf-laden.com", + "epayroll.solutions", + "eservce.biz", + "eservce.co.uk", + "eservce.fr", + "eservce.net", + "event-planer.com", + "exch01-corp.net", + "firstfedtrust.us", + "flight-status-alert.com", + "flight-status-alert.me", + "flightstatalert.net", + "freeenergypress.org", + "fundingsource.world", + "gift-club.tech", + "giftgreeting.com", + "global-bancaire.com", + "gmail-site.net", + "googli.online", + "gotwebinar.org", + "gov-services.net", + "grnail.online", + "health-line.website", + "healthline.care", + "hpdocument.net", + "hr-dept.live", + "hr-internal.co", + "hrmc.me.uk", + "ibwalletsecurelogin.com", + "info-week.biz", + "InformedVoterLeague.org", + "internalhr.tech", + "internalitsupport.net", + "investmentsecuresite.com", + "k-trafficxmj.co", + "k-trafficxmj.co.uk", + "k-trafficxmj.com", + "linkedincdn.co.uk", + "linkedincdn.net", + "linkedincdn.us", + "loanpaymentservices.com", + "localhostlocaldomain.net", + "mail-center-alert.net", + "mail-delivery-system.info", + "maliciousfile.com", + "maliciousfile.download", + "matchesonline.org", + "medical-site.space", + "meeting-reminder.net", + "metflix.pw", + "micrasoft-395office.com", + "micrasoft-onedrive.com", + "micrasoft.me", + "myensurance.services", + "mypayrollservice.net", + "NationalCouncil4not-for-profits.org", + "office-site.org", + "office-site.site", + "olympicresults.site", + "online-docshare.com", + "onlinebankingsevices.com", + "p183321.net", + "package-track.com", + "package-track.info", + "password-update.me", + "payment-center.io", + "payqal-login.com", + "phishingtraining.eu", + "ransomware.website", + "recruitpros.co", + "register-now.net", + "rnetflix.io", + "sale-shop.info", + "sales-online.co", + "scandoc-center.com", + "security-education.net", + "self-serve.ltd", + "shipping-notification.info", + "shippingtrack.cloud", + "shippingtracker.io", + "shopingnow.store", + "shoppingbuyrewards.com", + "sportstoday.life", + "sso-local.net", + "stubclub.net", + "swift-track.co.uk", + "swift-track.info", + "techsupport-corp.net", + "thedisasterrelief.net", + "therecruitpro.net", + "trackingupdate.site", + "user-account.net", + "verifier-sure.com", + "vobamobile.co", + "xerox-scandevice.com", + "yggui.de", + "yggui.li", + "youarebeingphished.com", + "yourexpo.co.uk" + ) + ) + or ( + any(headers.ips, .ip in ("13.55.65.8", "13.55.54.143")) + and sender.email.domain.root_domain in ( + "accounts-receivable.ltd", + "accountsmaintenance.net", + "acct-payable.store", + "acct-receivable.io", + "acct-receivable.pro", + "admissionshelpu.net", + "adobe-cloudservices.com", + "adobe0nline.com", + "adobee.info", + "aibabadeals.com", + "alibeba.org", + "amaznlogin.com", + "amazon-site.tech", + "amazoon.cc", + "amezon.website", + "securityeducation.com", + "bank-site.org", + "banking24.live", + "barterbox-payments.info", + "biz-assistant.net", + "breakingnews-now.site", + "business-services.website", + "c0ncurso1utions.com", + "cardservices.world", + "cloud-store.online", + "club-chatter.net", + "combase.online", + "Committee4StrongLeadership.net", + "corp-internal.site", + "corpinternal.co", + "cybersales-direct.com", + "debt-collections.me", + "dhlsite.store", + "doc-sign.services", + "docusign-site.co", + "donatesolutions.biz", + "donation-center.site", + "e-sale.me", + "e-servce.net", + "educationresource.online", + "egenciaonline.com", + "electioninfo.co", + "electionsdecision.live", + "email-quarantine.com", + "emeraldquestlogin.info", + "epayroll.ltd", + "essexhealthsystern.com", + "event-planer.co", + "flight-status-alert.site", + "freephoneupgrade.net", + "fundingsource.network", + "gift-club.site", + "gigarnartonline.com", + "gmail-site.org", + "googli.tech", + "gov-services.online", + "greetingstech.com", + "grnail.services", + "health-line.tech", + "healthline.group", + "hr-dept.io", + "hr-internal.online", + "ibwallet-securelogin.com", + "InformedVoterLeague.net", + "infoweek.net", + "internalhr.us", + "internalitsupports.com", + "investmentsecureportal.net", + "kompu82.com", + "loan-payments.online", + "macrosoft-onedrive.com", + "mailcenter-alerts.com", + "mail-center-alerts.com", + "marigoldbank-payments.com", + "matchesonline.ai", + "mawern.com", + "medical-site.tech", + "meeting-reminder.site", + "micrasoft-office365.online", + "micrasoft.io", + "my-wombank-online.com", + "myensurance.net", + "NationalCouncil4not-for-profits.net", + "office-site.info", + "office-site.space", + "one-drive-micrasoft.com", + "online-docshare.net", + "payment-center.me", + "paypol-login.net", + "perchaseonline-2016.net", + "register-now.co", + "rnetflix.net", + "sale-shop.co", + "sales-online.cloud", + "securebankingsevices.net", + "self-serve.group", + "sharepoint-onlinedocs.com", + "shippingtrack.blog", + "shippingtrack.org", + "shopingnow.online", + "shorehaminsurance.com", + "sportstoday.tech", + "stubclub.org", + "techsupport-corp.online", + "thedisasterrelief.online", + "tilburybank.com", + "trackingupdate.online", + "uinvest.pro", + "uq39.download", + "user-account.co", + "vobamobile.com", + "wombank-rewards.com", + "wombonk.com", + "worryfreeonlineauctions.com", + "yourdailyupload.net" + ) + ) + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation" diff --git a/insights/headers/phishing_simulation_right_hand_ai.yml b/insights/headers/phishing_simulation_right_hand_ai.yml new file mode 100644 index 00000000000..0ad2ac7c82c --- /dev/null +++ b/insights/headers/phishing_simulation_right_hand_ai.yml @@ -0,0 +1,47 @@ +name: "Right-Hand AI phishing simulation" +type: "query" +source: | + type.inbound + // Right-Hand publishes no dedicated header, so anchor on its sending IPs + // (52.74.95.172 = simulation; SendGrid/relay IPs) paired with a Right-Hand + // landing-page domain in the sender or a body link. + and any(headers.ips, + .ip in ( + "52.74.95.172", + "168.245.54.27", + "149.72.49.118", + "52.76.252.34" + ) + ) + and ( + sender.email.domain.root_domain in ( + "linktosso.com", + "resetlogin.com", + "account-protect.me", + "micrrosotf.com", + "linktologin.com", + "grnaill.com", + "mailboxaccess.com", + "linkdinapp.com", + "micosot.com", + "login-sso.com" + ) + or any(body.links, + .href_url.domain.root_domain in ( + "linktosso.com", + "resetlogin.com", + "account-protect.me", + "micrrosotf.com", + "linktologin.com", + "grnaill.com", + "mailboxaccess.com", + "linkdinapp.com", + "micosot.com", + "login-sso.com" + ) + ) + ) +severity: "informational" +tags: + - "Headers" + - "Phishing simulation"