Brand Impersonation: Disney

  1name: "Brand Impersonation: Disney"
  2description: "Detects messages from senders impersonating Disney through display name spoofing or brand logo usage, combined with security-themed content and suspicious authentication patterns."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  and (
  8    // display name contains Disney
  9    (
 10      (
 11        strings.ilike(strings.replace_confusables(sender.display_name),
 12                      '*disney*'
 13        )
 14        and not strings.ilike(strings.replace_confusables(sender.display_name),
 15                              '*disney springs*'
 16        )
 17      )
 18      // levenshtein distance similar to Disney
 19      or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
 20                              'disney'
 21      ) <= 1
 22      or any(ml.logo_detect(file.message_screenshot()).brands,
 23             .name == "Disney" and .confidence == "high"
 24      )
 25    )
 26  )
 27  and (
 28    (
 29      any(ml.nlu_classifier(body.current_thread.text).topics,
 30          .name in (
 31            "Security and Authentication",
 32            "Secure Message",
 33            "Reminders and Notifications"
 34          )
 35          and .confidence in ("medium", "high")
 36      )
 37      and not any(ml.nlu_classifier(body.current_thread.text).topics,
 38                  .name in ("Newsletters and Digests", "Entertainment and Sports")
 39                  and .confidence in ("medium", "high")
 40      )
 41    )
 42    or (
 43      beta.ocr(file.message_screenshot()).text != ""
 44      and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
 45              .name in (
 46                "Security and Authentication",
 47                "Secure Message",
 48                "Reminders and Notifications"
 49              )
 50              and .confidence in ("medium", "high")
 51      )
 52      and not any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
 53                  .name in ("Newsletters and Digests", "Entertainment and Sports")
 54                  and .confidence in ("medium", "high")
 55      )
 56    )
 57    or any(ml.nlu_classifier(body.current_thread.text).intents,
 58           .name == "cred_theft" and .confidence == "high"
 59    )
 60    or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
 61           .name == "cred_theft" and .confidence == "high"
 62    )
 63  )
 64  
 65  // and the sender is not in org_domains or from Disney domains and passes auth
 66  and not (
 67    sender.email.domain.root_domain in $org_domains
 68    or (
 69      // from https://github.com/v2fly/domain-list-community/blob/master/data/disney
 70      sender.email.domain.root_domain in (
 71        "disney.asia",
 72        "disney.be",
 73        "disney.bg",
 74        "disney.ca",
 75        "disney.ch",
 76        "disney.co.il",
 77        "disney.co.jp",
 78        "disney.co.kr",
 79        "disney.co.th",
 80        "disney.co.uk",
 81        "disney.co.za",
 82        "disney.com",
 83        "disney.com.au",
 84        "disney.com.br",
 85        "disney.com.hk",
 86        "disney.com.tw",
 87        "disney.cz",
 88        "disney.de",
 89        "disney.dk",
 90        "disney.es",
 91        "disney.fi",
 92        "disney.fr",
 93        "disney.gr",
 94        "disney.hu",
 95        "disney.id",
 96        "disney.in",
 97        "disney.io",
 98        "disney.it",
 99        "disney.my",
100        "disney.nl",
101        "disney.no",
102        "disney.ph",
103        "disney.pl",
104        "disney.pt",
105        "disney.ro",
106        "disney.ru",
107        "disney.se",
108        "disney.sg",
109        "disneysurveys.com",
110        "disneyonline.com",
111        "disneyaccount.com",
112        "disneyadvertising.com",
113        "disneydestinations.com",
114        "hulu.com",
115        "hulumail.com",
116        "canarytechnologies.com", // domain used by a disney resort - hotel mgmt software company
117        "disneyvacationclub.com",
118        "twdc.com",
119        "disneyrewards.com",
120        "disneystore.com",
121        "disneyworld.com"
122      )
123      and headers.auth_summary.dmarc.pass
124    )
125  )
126  // and the sender is not from high trust sender root domains
127  and (
128    (
129      sender.email.domain.root_domain in $high_trust_sender_root_domains
130      and not headers.auth_summary.dmarc.pass
131    )
132    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
133  )
134  and (
135    not profile.by_sender().solicited
136    or not headers.auth_summary.dmarc.pass
137    or not headers.auth_summary.spf.pass
138  )  
139attack_types:
140  - "Credential Phishing"
141tactics_and_techniques:
142  - "Impersonation: Brand"
143  - "Social engineering"
144detection_methods:
145  - "Computer Vision"
146  - "Natural Language Understanding"
147  - "Content analysis"
148  - "Header analysis"
149  - "Sender analysis"
150id: "bf90b8fb-3f6e-5831-9b3c-1d05b2a4a863"