Brand impersonation: Automobile assistance associations

 1name: "Brand impersonation: Automobile assistance associations"
 2description: "Detects messages impersonating automobile associations (AAA, CAA, RAC, etc.) offering vehicle emergency kits or roadside assistance services from untrusted senders."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(ml.nlu_classifier(body.current_thread.text).entities,
 8          .name in ("org", "sender")
 9          and regex.contains(.text, '\b(?:AAA|RAC|RAA|CAA|BCAA|AMA)\b')
10  )
11  and regex.icontains(body.current_thread.text,
12                      '(?:car|vehicle|motor|driver|emergency|road.?side|break.?down|assist|save|discount|complimentary|free\b).{0,10}kit'
13  )
14  // and the sender is not from high trust sender root domains
15  and not (
16    sender.email.domain.root_domain in $high_trust_sender_root_domains
17    and coalesce(headers.auth_summary.dmarc.pass, false)
18  )
19  // negate newsletters and quarantine notifications
20  and not (
21    any(ml.nlu_classifier(body.current_thread.text).topics,
22        .name in ("Newsletters and Digests") and .confidence != "low"
23    )
24    or strings.icontains(subject.subject, "quarantine")
25  )  
26
27attack_types:
28  - "Credential Phishing"
29tactics_and_techniques:
30  - "Impersonation: Brand"
31  - "Social engineering"
32detection_methods:
33  - "Content analysis"
34  - "Natural Language Understanding"
35  - "Header analysis"
36  - "Sender analysis"
37id: "283f7fe5-afa2-5a2b-bd6c-0df687ed4a11"