KnowBe4 YARA Rules for PhishER

rule CEO_Fraud
{
  strings:
    $FromEmail        = /From:.{0,20}\<[[email protected]]\>/ nocase
    $FromName	        = /From:.{0,20}[yourCEO].{0,20}<.{5,100}>/ nocase
    $FromNameEmail    = /From:.{0,20}[yourCEO].{0,20}\<[[email protected]]\>/ nocase

    $Reply            = /Reply-To:.{0,20}/ nocase
    $ReplyEmail       = /Reply-To:.{0,20}\<[[email protected]]\>/ nocase
    $ReplyName	      = /Reply-To:.{0,20}[yourCEO].{0,20}\</ nocase
    $ReplyNameEmail   = /Reply-To:.{0,20}[yourCEO].{0,20}\<[[email protected]]\>/ nocase

  condition:
    ($Reply and $FromNameEmail and not $ReplyNameEmail)
    or ($Reply and not $FromNameEmail and $ReplyNameEmail)
    or ($Reply and $FromEmail and not $ReplyEmail)
    or ($Reply and not $FromEmail and $ReplyEmail)
    or ($FromName and not $FromEmail)
    or ($ReplyName and not $ReplyNameEmail)
}

If you use this rule, you’ll need to replace each instance of the [[email protected]] placeholder with your CEO’s email address. You’ll also need to replace each instance of the [yourCEO] placeholder with your CEO’s name.

Internal Sender Rule

a YARA rule that identifies any email coming from your domain that is not a spoofed email

rule InternalSender
{
  strings:
	$a = /from:.{0,60}@domain.com/ nocase
	$b = /Return-Path:.{0,60}@domain.com/ nocase
	$c = "header.from=domain.com"
	$d = /Authentication-Results:.{0,20}spf=pass/ nocase
	
  condition:
    all of them
}

Note: If you use this rule, the email will need a matching sender domain in the headers and will need to pass your Sender Policy Framework (SPF) checks. This rule will not tag emails sent from your domain that do not require or pass your SPF checks. If you would like to tag the types of emails mentioned, remove the $d string. You can also remove the $c string.

KnowBe4 Training Emails Rule

  a YARA rule that detects all training notification emails from your KMSAT console

rule KnowBe4_TrainingEmails
{
  strings:
  $ = /Return-Path:.{0,50}psm.knowbe4.com>/ nocase
  $ = /Received:.{0,50}(147.160.167.\d{1,3})/ nocase
  $ = /Received:.{0,50}(23.21.109.197)/ nocase
  $ = /Received:.{0,50}(23.21.109.212)/ nocase
  $ = /Received:.{0,50}psm.knowbe4.com/ nocase

  condition:
    any of them
}

KnowBe4 Training Emails Rule

 a YARA rule that detects if a value is not present in a selected PhishER target (click to view)

rule notPresent
{
  strings:
    $a = "KnowBe4" nocase

  condition:
    (not $a) and (filesize > 0)
}

To use this rule, you’ll need to include the special variable filesize in your rule’s condition. The filesize variable checks if the target you selected is empty. This process is helpful if you receive an email with a plain text body and an HTML body since one type of body could be empty but the other body could contain your string. Without the filesize variable, the email could falsely match your notPresent rule.

Most Common Regular Expressions Table

A regular expression, or regex, is a sequence of characters that is used to identify a pattern in text strings. To learn about regular expressions that are often used in YARA rules for PhishER, see the table below. For more information about regular expressions, see YARA’s Writing YARA rules documentation.

Examples:

• .at matches any three-character string ending with “at”, including “hat”, “cat”, “bat”, “4at”, “#at” and ” at” (starting with a space).
• [hc]at matches “hat” and “cat”.
• [^b]at matches all strings matched by .at except “bat”.
• [^hc]at matches all strings matched by .at other than “hat” and “cat”.
• ^[hc]at matches “hat” and “cat”, but only at the beginning of the string or line.
• [hc]at$ matches “hat” and “cat”, but only at the end of the string or line.
• \[.\] matches any single character surrounded by “[” and “]” since the brackets are escaped, for example: “[a]”, “[b]”, “[7]”, “[@]”, “[]]”, and “[ ]” (bracket space bracket).
• s.* matches s followed by zero or more characters, for example: “s”, “saw”, “seed”, “s3w96.7”, and “s6#h%(>>>m n mQ”.

POSIX extended[edit]

The meaning of metacharacters escaped with a backslash is reversed for some characters in the POSIX Extended Regular Expression (ERE) syntax. With this syntax, a backslash causes the metacharacter to be treated as a literal character. So, for example, \( \) is now ( ) and \{ \} is now { }. Additionally, support is removed for \n backreferences and the following metacharacters are added:

Examples:

• [hc]?at matches “at”, “hat”, and “cat”.
• [hc]*at matches “at”, “hat”, “cat”, “hhat”, “chat”, “hcat”, “cchchat”, and so on.
• [hc]+at matches “hat”, “cat”, “hhat”, “chat”, “hcat”, “cchchat”, and so on, but not “at”.
• cat|dog matches “cat” or “dog”.