Brand impersonation: Bluehost

 1name: "Brand impersonation: Bluehost"
 2description: "Detects inbound messages where NLU-extracted sender or organization entities reference 'Bluehost' and the message intent is classified as credential theft with non-low confidence. Excludes messages from verified Bluehost-related domains (bluehost.com, bluehost.in, newfold.com, ccsend.com) or other high-trust sender domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(ml.nlu_classifier(body.current_thread.text).entities,
 8          .name in ("sender", "org") and strings.icontains(.text, 'bluehost')
 9  )
10  and any(ml.nlu_classifier(body.current_thread.text).intents,
11          .name == "cred_theft" and .confidence != "low"
12  )
13  and not (
14    sender.email.domain.root_domain in (
15      "bluehost.com",
16      "bluehost.in",
17      "newfold.com",
18      "ccsend.com"
19    )
20    and coalesce(headers.auth_summary.dmarc.pass, false)
21  )
22  and not (
23    sender.email.domain.root_domain in $high_trust_sender_root_domains
24    and coalesce(headers.auth_summary.dmarc.pass, false)
25  )  
26attack_types:
27  - "Credential Phishing"
28tactics_and_techniques:
29  - "Impersonation: Brand"
30  - "Social engineering"
31detection_methods:
32  - "Natural Language Understanding"
33  - "Header analysis"
34  - "Sender analysis"
35id: "c5b72c08-5afc-58ad-903e-9b7859a67cf4"