Brand impersonation: Automobile assistance associations

 1name: "Brand impersonation: Automobile assistance associations"
 2description: "Detects messages impersonating automobile associations (AAA, CAA, RAC, etc.) offering vehicle emergency kits or roadside assistance services from untrusted senders."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and (
 8    any(ml.nlu_classifier(body.current_thread.text).entities,
 9        .name in ("org", "sender")
10        and regex.contains(.text, '\b(?:AAA|RAC|RAA|CAA|BCAA|AMA)\b')
11    )
12    or strings.istarts_with(sender.email.local_part, 'aaa')
13  )
14  and regex.icontains(body.current_thread.text,
15                      '(?:car|vehicle|motor|driver|emergency|road.?side|break.?down|assist|save|discount|complimentary|free\b).{0,10}kit'
16  )
17  // and the sender is not from high trust sender root domains
18  and not (
19    sender.email.domain.root_domain in $high_trust_sender_root_domains
20    and coalesce(headers.auth_summary.dmarc.pass, false)
21  )
22  // negate newsletters and quarantine notifications
23  and not (
24    any(ml.nlu_classifier(body.current_thread.text).topics,
25        .name in ("Newsletters and Digests") and .confidence != "low"
26    )
27    or strings.icontains(subject.subject, "quarantine")
28  )  
29
30attack_types:
31  - "Credential Phishing"
32tactics_and_techniques:
33  - "Impersonation: Brand"
34  - "Social engineering"
35detection_methods:
36  - "Content analysis"
37  - "Natural Language Understanding"
38  - "Header analysis"
39  - "Sender analysis"
40id: "283f7fe5-afa2-5a2b-bd6c-0df687ed4a11"