Brand impersonation: Amazon Web Services (AWS)

 1name: "Brand impersonation: Amazon Web Services (AWS)"
 2description: "Detects messages impersonating AWS through similar display names combined with security-themed content and authentication failures. Excludes legitimate AWS communications and trusted senders."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and regex.icontains(strings.replace_confusables(sender.display_name),
 8                      '\baws\b|amazon web services|\bses\b'
 9  )
10  and (
11    // ML Topic Analysis and Credential Theft Detection
12    any(ml.nlu_classifier(body.current_thread.text).topics,
13        .name in ("Security and Authentication", "Secure Message")
14        and .confidence == "high"
15    )
16    or (
17      beta.ocr(file.message_screenshot()).text != ""
18      and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
19              .name in ("Security and Authentication", "Secure Message")
20              and .confidence == "high"
21      )
22    )
23    or any(ml.nlu_classifier(body.current_thread.text).intents,
24           .name == "cred_theft" and .confidence == "high"
25    )
26    or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
27           .name == "cred_theft" and .confidence == "high"
28    )
29  )
30  // Not from legitimate AWS domains
31  // there was a DMARC check here, but a lot of users send AWS notifications to groups/mailing lists that breaks DMARC
32  and not (
33    sender.email.domain.root_domain in $org_domains
34    or sender.email.domain.root_domain in (
35      "amazon.com",
36      "amazonaws.com",
37      "amazonses.com",
38      "awsevents.com",
39      "awsmp-seller-conference.com",
40      "aws-experience.com",
41      "marketplace.aws",
42      "aws.com",
43      "amazonaws.cn",
44      "repost.aws",
45      "awscustomercouncil.com",
46      "airtableemail.com", // used for re:Invent
47      "nmls.org", // "state examination system", realtor software
48      "mktgcampaigns.com", // Elastic + AWS co-marketing emails
49      "awseducate.com",
50      "awsacademy.com"
51    )
52    or sender.email.domain.tld == "local"
53  )
54  // negate highly trusted sender domains unless they fail DMARC authentication
55  and (
56    (
57      sender.email.domain.root_domain in $high_trust_sender_root_domains
58      and not headers.auth_summary.dmarc.pass
59    )
60    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
61  )
62  // sender email specific
63  and not (
64    profile.by_sender_email().solicited
65    // sender domain specific
66    or (
67      profile.by_sender().solicited
68      // 30 day decay
69      and (profile.by_sender().days_since.last_contact < 30)
70    )
71  )  
72
73attack_types:
74  - "Credential Phishing"
75tactics_and_techniques:
76  - "Impersonation: Brand"
77  - "Social engineering"
78detection_methods:
79  - "Content analysis"
80  - "Header analysis"
81  - "Optical Character Recognition"
82  - "Sender analysis"
83  - "Natural Language Understanding"
84id: "31de94e0-8c93-5408-929f-f448eea91830"