New rule (Brand impersonation) Fake file sharing with procurement theme

detection-rules/impersonation_fake_file_share_suspicious_indicators.yml

@@ -0,0 +1,78 @@
+name: "Brand impersonation: Fake file sharing notification with procurement theme"
+description: "Detects messages impersonating file sharing services that contain specific HTML table structures with document type, recipient, and date fields, along with procurement-themed signatures and various suspicious HTML artifacts including AI generation comments or tracking pixels."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and (
+    strings.icontains(body.current_thread.text, "You've Received a File")
+    or (
+      strings.icontains(body.current_thread.text, "Review File")
+      and strings.icontains(body.current_thread.text,
+                            "shared a file with you for review"
+      )
+    )
+  )
+  and (
+    // body table structure: contains document type, recipient, date rows
+    (
+      any(html.xpath(body.html, '//td').nodes,
+          strings.icontains(.raw, 'Document type')
+      )
+      and any(html.xpath(body.html, '//td').nodes,
+              strings.icontains(.raw, 'Recipient')
+      )
+      and any(html.xpath(body.html, '//td').nodes,
+              regex.icontains(.raw, 'Date:?')
+      )
+    )
+  )
+  and (
+    // blue button
+    any(html.xpath(body.html, '//a').nodes,
+        regex.icontains(.raw, 'background[:\s]*#3a78d1')
+    )
+  )
+  and (
+    // "Thank you, {org_name} Procurement"
+    (
+      any(html.xpath(body.html, '//p').nodes,
+          strings.icontains(.raw, 'Thank you')
+      )
+      and any(html.xpath(body.html, '//p').nodes,
+              regex.icontains(.raw, '\bProcurement\b')
+      )
+    )
+    or 
+    // Or the broken anchor tag artifact
+    regex.icontains(body.html.raw, '<a\s*<')
+  )
+  and (
+    // AI generation comment
+    any(html.xpath(body.html, '//comment()').nodes,
+        regex.icontains(.raw, '(as requested)')
+    )
+    // rounded white card container
+    or (
+      regex.icontains(body.html.raw, 'border-radius:\s*6px')
+      and regex.icontains(body.html.raw, 'background:\s*#fff')
+    )
+    // tracking pixel from uplanner
+    or any(html.xpath(body.html, '//img[@width="1"][@height="1"]').nodes,
+           strings.icontains(.raw, 'uplanner.com')
+    )
+    // "shared a file with you for review" body pattern
+    or any(html.xpath(body.html, '//p').nodes,
+           regex.icontains(.raw, 'shared a file with you for review')
+    )
+  )
+attack_types:
+  - "Credential Phishing"
+  - "BEC/Fraud"
+tactics_and_techniques:
+  - "Impersonation: Brand"
+  - "Social engineering"
+detection_methods:
+  - "Content analysis"
+  - "HTML analysis"
+id: "263c1548-eb03-506f-8b59-3a27adfd19eb"