detect_possible_execution_of_phishing_attachment

rule detect_possible_execution_of_phishing_attachment {
 meta:
    author = "Joseph Kamau"
    description = "This rule detects when a process is created from the execution of a possible malicoius email attachment sent as malspam or spear phishing attempts based on the most prevalent naming techniques and extensions.This rule would be ideal for hunting for phishing attacks that would have gone undetected  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/eQp3NR1Vg8pm"
    version = "0.01"
    created = "2021-03-09"
    product = "windows"
    category = "process_creation"
    mitre = "initial_access, t1566, t1566.001, t1566.002"

  events:
((re.regex($selection.target.process.command_line, `.*.*pdf\.exe`) or re.regex($selection.target.process.command_line, `.*.*pdf\.zip`) or re.regex($selection.target.process.command_line, `.*.*pdf\.7zp`) or re.regex($selection.target.process.command_line, `.*\\order.*\.jar`) or re.regex($selection.target.process.command_line, `.*\\payment.*\.jar`) or re.regex($selection.target.process.command_line, `.*\\shipping.*\.exe`) or re.regex($selection.target.process.command_line, `.*\\shipping.*\.jar`) or re.regex($selection.target.process.command_line, `.*\\purchase.*\.jar`) or re.regex($selection.target.process.command_line, `.*.*\.arj`) or re.regex($selection.target.process.command_line, `.*.*\.xz`) or re.regex($selection.target.process.command_line, `.*.*pdf\.gz`) or re.regex($selection.target.process.command_line, `.*\\quotation.*\.jar`) or re.regex($selection.target.process.command_line, `.*\\order.*\.zip`) or re.regex($selection.target.process.command_line, `.*.*xls\.zip`) or re.regex($selection.target.process.command_line, `.*\\swift.*\.jar`) or re.regex($selection.target.process.command_line, `.*\\invoice.*\.jar`) or re.regex($selection.target.process.command_line, `.*\\invoice.*\.exe`) or re.regex($selection.target.process.command_line, `.*\\shipping advice.*\.exe`) or re.regex($selection.target.process.command_line, `.*\\shipping advice.*\.jar`) or re.regex($selection.target.process.command_line, `.*\\Airway bill.*\.exe`) or re.regex($selection.target.process.command_line, `.*\\Airway bill.*\.jar`) or re.regex($selection.target.process.command_line, `.*\\DHL.*\.exe`) or re.regex($selection.target.process.command_line, `.*\\Corona.*\.exe`) or re.regex($selection.target.process.command_line, `.*\\Covid.*\.exe`) or re.regex($selection.target.process.command_line, `.*\\corona.*\.doc`) or re.regex($selection.target.process.command_line, `.*\\covid.*\.doc`) or re.regex($selection.target.process.command_line, `.*.*\.bat\.rar`) or re.regex($selection.target.process.command_line, `.*.*\.zip\.xxe`) or re.regex($selection.target.process.command_line, `.*.*\.xlsx\.swf`) or re.regex($selection.target.process.command_line, `.*\\PO`) or re.regex($selection.target.process.command_line, `.*\\Invoice`)) and ($selection.metadata.product_event_type = "4688" or $selection.metadata.product_event_type = "1"))

  condition:
    $selection
}