Brand Impersonation: Disney
Detects messages from senders impersonating Disney through display name spoofing or brand logo usage, combined with security-themed content and suspicious authentication patterns.
Sublime rule (View on GitHub)
1name: "Brand Impersonation: Disney"
2description: "Detects messages from senders impersonating Disney through display name spoofing or brand logo usage, combined with security-themed content and suspicious authentication patterns."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and (
8 // display name contains Disney
9 (
10 (
11 strings.ilike(strings.replace_confusables(sender.display_name),
12 '*disney*'
13 )
14 and not strings.ilike(strings.replace_confusables(sender.display_name),
15 '*disney springs*'
16 )
17 )
18 // levenshtein distance similar to Disney
19 or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
20 'disney'
21 ) <= 1
22 or any(ml.logo_detect(file.message_screenshot()).brands,
23 .name == "Disney" and .confidence == "high"
24 )
25 )
26 )
27 and (
28 (
29 any(beta.ml_topic(body.current_thread.text).topics,
30 .name in (
31 "Security and Authentication",
32 "Secure Message",
33 "Reminders and Notifications"
34 )
35 and .confidence in ("medium", "high")
36 )
37 and not any(beta.ml_topic(body.current_thread.text).topics,
38 .name in ("Newsletters and Digests", "Entertainment and Sports")
39 and .confidence in ("medium", "high")
40 )
41 )
42 or (
43 any(beta.ml_topic(beta.ocr(file.message_screenshot()).text).topics,
44 .name in (
45 "Security and Authentication",
46 "Secure Message",
47 "Reminders and Notifications"
48 )
49 and .confidence in ("medium", "high")
50 and beta.ocr(file.message_screenshot()).text != ""
51 )
52 and not any(beta.ml_topic(beta.ocr(file.message_screenshot()).text).topics,
53 .name in ("Newsletters and Digests", "Entertainment and Sports")
54 and .confidence in ("medium", "high")
55 )
56 )
57 or any(ml.nlu_classifier(body.current_thread.text).intents,
58 .name == "cred_theft" and .confidence == "high"
59 )
60 or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
61 .name == "cred_theft" and .confidence == "high"
62 )
63 )
64
65 // and the sender is not in org_domains or from Disney domains and passes auth
66 and not (
67 sender.email.domain.root_domain in $org_domains
68 or (
69 // from https://github.com/v2fly/domain-list-community/blob/master/data/disney
70 sender.email.domain.root_domain in (
71 "disney.asia",
72 "disney.be",
73 "disney.bg",
74 "disney.ca",
75 "disney.ch",
76 "disney.co.il",
77 "disney.co.jp",
78 "disney.co.kr",
79 "disney.co.th",
80 "disney.co.uk",
81 "disney.co.za",
82 "disney.com",
83 "disney.com.au",
84 "disney.com.br",
85 "disney.com.hk",
86 "disney.com.tw",
87 "disney.cz",
88 "disney.de",
89 "disney.dk",
90 "disney.es",
91 "disney.fi",
92 "disney.fr",
93 "disney.gr",
94 "disney.hu",
95 "disney.id",
96 "disney.in",
97 "disney.io",
98 "disney.it",
99 "disney.my",
100 "disney.nl",
101 "disney.no",
102 "disney.ph",
103 "disney.pl",
104 "disney.pt",
105 "disney.ro",
106 "disney.ru",
107 "disney.se",
108 "disney.sg",
109 "disneysurveys.com",
110 "disneyonline.com",
111 "disneyaccount.com",
112 "disneyadvertising.com",
113 "disneydestinations.com",
114 "hulu.com",
115 "hulumail.com",
116 "canarytechnologies.com", // domain used by a disney resort - hotel mgmt software company
117 "disneyvacationclub.com",
118 "twdc.com"
119 )
120 and headers.auth_summary.dmarc.pass
121 )
122 )
123 // and the sender is not from high trust sender root domains
124 and (
125 (
126 sender.email.domain.root_domain in $high_trust_sender_root_domains
127 and not headers.auth_summary.dmarc.pass
128 )
129 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
130 )
131 and (
132 not profile.by_sender().solicited
133 or not headers.auth_summary.dmarc.pass
134 or not headers.auth_summary.spf.pass
135 )
136
137attack_types:
138 - "Credential Phishing"
139tactics_and_techniques:
140 - "Impersonation: Brand"
141 - "Social engineering"
142detection_methods:
143 - "Computer Vision"
144 - "Natural Language Understanding"
145 - "Content analysis"
146 - "Header analysis"
147 - "Sender analysis"
148id: "bf90b8fb-3f6e-5831-9b3c-1d05b2a4a863"