Brand impersonation: AARP

 1name: "Brand impersonation: AARP"
 2description: "Detects messages impersonating AARP by analyzing sender display name and body content for AARP references, address information, or survey-related language from unauthorized senders."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      strings.icontains(sender.display_name, "AARP")
10      and any(ml.nlu_classifier(body.current_thread.text).entities,
11              .name in ("request", "financial")
12              and regex.icontains(.text, "(?:gift|win|free|renewal)")
13      )
14    )
15    or 2 of (
16      strings.icontains(body.current_thread.text, 'AARP'),
17      strings.icontains(body.current_thread.text, '601 E Street NW'),
18      strings.icontains(body.current_thread.text, 'Washington, DC 20049')
19    )
20    or (
21      strings.icontains(body.current_thread.text, 'AARP')
22      and (
23        regex.icontains(body.current_thread.text,
24                        'quick .{0,10}survey',
25                        '\bAAR-[A-Za-z0-9]{0,}(-[A-Za-z0-9]{0,})?', // member number regex
26                        'comp[Il]imentary item' // contains a suspicious captilization
27        )
28        or strings.icontains(body.current_thread.text,
29                             "last attempt",
30                             "renewal is complete",
31                             "select membership item"
32        )
33      )
34    )
35    //
36    // This rule makes use of a beta feature and is subject to change without notice
37    // using the beta feature in custom rules is not suggested until it has been formally released
38    //
39    or (
40      strings.icontains(beta.ocr(file.message_screenshot()).text, "AARP")
41      and strings.icontains(beta.ocr(file.message_screenshot()).text,
42                            "join or renew now"
43      )
44      and strings.icontains(beta.ocr(file.message_screenshot()).text,
45                            "to opt out"
46      )
47    )
48  )
49  // negate job postings related to AARP and newsletters containing AARP
50  and not any(ml.nlu_classifier(body.current_thread.text).topics,
51              .name in (
52                "Professional and Career Development",
53                "Newsletters and Digests"
54              )
55              and .confidence == "high"
56  )
57  // and the sender is not in org_domains or from AARP domains and passes auth
58  and not (
59    sender.email.domain.root_domain in $org_domains
60    or (
61      sender.email.domain.root_domain in (
62        "aarp.org",
63        "proofpointessentials.com",
64        "expedia.com",
65        "eventbrite.com",
66        "zixcorp.com"
67      )
68      and headers.auth_summary.dmarc.pass
69    )
70  )  
71attack_types:
72  - "BEC/Fraud"
73  - "Credential Phishing"
74tactics_and_techniques:
75  - "Impersonation: Brand"
76  - "Social engineering"
77detection_methods:
78  - "Content analysis"
79  - "Header analysis"
80  - "Sender analysis"
81id: "561a7f87-0af7-5f34-8d5d-86bdc0fe213d"