Skip to content

Commit

Permalink
Sync from PR#2159
Browse files Browse the repository at this point in the history 
Create spam_google_group_invite.yml by @zoomequipd
#2159
Source SHA 27f9990
Triggered by @zoomequipd
  • Loading branch information
Sublime Rule Testing Bot committed Dec 26, 2024
1 parent 27fbc80 commit 8cb29fe
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions detection-rules/spam_google_group_invite.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: "Spam: Google Groups Invitations"
description: "Detects suspicious Google Groups invitations containing inappropriate content or suspicious patterns. The rule looks for invites from non-organizational domains that contain random alphanumeric strings, explicit keywords, or suspicious call-to-action phrases in the group names or descriptions."
type: "rule"
severity: "low"
source: "type.inbound\n// \n// Warning: This rule contains sexually explict keywords\n// \nand sender.email.email == \"noreply@groups.google.com\"\nand (\n strings.istarts_with(subject.subject, 'Invitation to join ')\n or strings.istarts_with(subject.subject, 'You have been added to ')\n // the group name contains sexually explict keywords\n or\n regex.icontains(subject.subject, '(?:Invitation to join|You have been added to) .*(?:sex|horny|cock|fuck|ass|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes|sexting|cheating|affair|erotic|lust|desire|intimate|explicit|fetish|kinky|seduce)')\n)\n// the invite is not from an $org_domain user\nand not any($org_domains,\n strings.icontains(body.current_thread.text,\n strings.concat('@',\n .,\n ' invited you to join the '\n )\n )\n or strings.icontains(body.current_thread.text,\n strings.concat('@', ., ' added you to the ')\n )\n)\nand (\n // the group name contains 7 char sets at the start and end and must contain a number\n regex.icontains(subject.subject,\n '(?:added to|to join) [A-Z0-9]{6,7} .*(?:[[:^ascii:]]|[[:^alpha:]]) [A-Z0-9]{6,7}$'\n )\n // calls to action in the group name\n or regex.icontains(subject.subject,\n '(?:added to|to join) .*(join|(?:click|go|tap) here)'\n )\n // it contains an emoji in the group name\n or regex.icontains(subject.subject,\n '(?:added to|to join) .*[\\x{1F300}-\\x{1F5FF}\\x{1F600}-\\x{1F64F}\\x{1F680}-\\x{1F6FF}\\x{1F700}-\\x{1F77F}\\x{1F780}-\\x{1F7FF}\\x{1F900}-\\x{1F9FF}\\x{2600}-\\x{26FF}\\x{2700}-\\x{27BF}\\x{2300}-\\x{23FF}]'\n )\n // the description of the group contains sexually explict keywords \n or \n regex.icontains(body.current_thread.text, '(?:about this group|message from).*(?:(sex|horny|cock|fuck|ass|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes|sexting|cheating|affair|erotic|lust|desire|intimate|explicit|fetish|kinky|seduce)).*https?://')\n // the invitor is an email domain which contains 3 labels\n or \n regex.icontains(body.current_thread.text, '\\n[^\\@]+@(?:[a-zA-Z0-9-]{1,255}\\.){2}[a-zA-Z0-9-]{2,255} (?:added you to the|invited you to join the)')\n)\n"
source: "type.inbound\n// \n// Warning: This rule contains sexually explict keywords\n// \nand sender.email.email == \"noreply@groups.google.com\"\nand (\n strings.istarts_with(subject.subject, 'Invitation to join ')\n or strings.istarts_with(subject.subject, 'You have been added to ')\n // the group name contains sexually explict keywords\n or\n regex.icontains(subject.subject, '(?:Invitation to join|You have been added to) .*(?:sex|horny|cock|fuck|\\bass\\b|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes|sexting|cheating|affair|erotic|lust|desire|intimate|explicit|fetish|kinky|seduce)')\n)\n// the invite is not from an $org_domain user\nand not any($org_domains,\n strings.icontains(body.current_thread.text,\n strings.concat('@',\n .,\n ' invited you to join the '\n )\n )\n or strings.icontains(body.current_thread.text,\n strings.concat('@', ., ' added you to the ')\n )\n)\nand (\n // the group name contains 7 char sets at the start and end and must contain a number\n regex.icontains(subject.subject,\n '(?:added to|to join) [A-Z0-9]{5,7} .*(?:[[:^ascii:]]|[[:^alpha:]]) [A-Z0-9]{5,7}$'\n )\n // calls to action in the group name\n or regex.icontains(subject.subject,\n '(?:added to|to join) .*(join|(?:click|go|tap) here)'\n )\n // it contains an emoji in the group name\n or regex.icontains(subject.subject,\n '(?:added to|to join) .*[\\x{1F300}-\\x{1F5FF}\\x{1F600}-\\x{1F64F}\\x{1F680}-\\x{1F6FF}\\x{1F700}-\\x{1F77F}\\x{1F780}-\\x{1F7FF}\\x{1F900}-\\x{1F9FF}\\x{2600}-\\x{26FF}\\x{2700}-\\x{27BF}\\x{2300}-\\x{23FF}]'\n )\n // the description of the group contains sexually explict keywords \n or \n regex.icontains(body.current_thread.text, '(?:about this group|message from).*(?:(sex|horny|cock|fuck|\\bass\\b|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes|sexting|cheating|affair|erotic|lust|desire|intimate|explicit|fetish|kinky|seduce)).*https?://')\n // the invitor is an email domain which contains 3 labels\n or \n (regex.icontains(body.current_thread.text, '\\n[^\\@]+@(?:[a-zA-Z0-9-]{1,255}\\.){2}[a-zA-Z0-9-]{2,255} (?:added you to the|invited you to join the)')\n // where the group name contains \"lists.\"\n and not regex.icontains(body.current_thread.text, '\\n[^\\@]+@(?:[a-zA-Z0-9-]{1,255}\\.){2}[a-zA-Z0-9-]{2,255} (?:added you to the|invited you to join the) [^\\@]+\\@lists\\.')\n )\n)\n"
attack_types:
- "Spam"
tactics_and_techniques:
Expand All @@ -13,4 +13,4 @@ detection_methods:
- "Sender analysis"
id: "4e0bec29-be9c-526f-ad56-824b4d87f55d"
testing_pr: 2159
testing_sha: f8e971a52ee4410b250f42d4f8e91909aaf30196
testing_sha: 27f999089a9420b32beb85a22e7cdc647929fe88

0 comments on commit 8cb29fe

Please sign in to comment.