Create google classroom spoof alert

[IndiaAce]

Description

From a runner, creating coverage for google classroom spoofing. Similar to Zoom Docs abuse.

Associated samples

• Sample 1

Associated hunts

• Hunt 1
• Updated Hunt with improved scope

[MSAdministrator]

The following was supplied by a community member in Slack. Here's the MQL they provided:

type.inbound
and sender.email.email == "no-reply@classroom.google.com"
and any(file.explode(beta.message_screenshot()),
        // WhatsApp number regex
        (
          regex.icontains(.scan.ocr.raw,
                          '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{3}',
                          '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{3}'
          )
          // phone number regex
          or regex.icontains(.scan.ocr.raw,
                             '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                             '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
          )
        )
)

The thread is here

[IndiaAce]

The following was supplied by a community member in Slack. Here's the MQL they provided:

type.inbound
and sender.email.email == "no-reply@classroom.google.com"
and any(file.explode(beta.message_screenshot()),
        // WhatsApp number regex
        (
          regex.icontains(.scan.ocr.raw,
                          '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{3}',
                          '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{3}'
          )
          // phone number regex
          or regex.icontains(.scan.ocr.raw,
                             '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                             '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
          )
        )
)

The thread is here

Thanks for this! Updating rule to contain the provided logic as an or statement to expand coverage.