Brand impersonation: Evite

 1name: "Brand impersonation: Evite"
 2description: "Detects messages impersonating Evite invitations by looking for invitation language while not originating from legitimate Evite domains."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.icontains(body.html.raw, 'evite')
 8  and any(html.xpath(body.html, '//img/@src').nodes,
 9          // calling parse_url allows url decoding to help us
10          strings.parse_url(.raw).domain.root_domain in (
11            'evitecdn.com',
12            'evite.com'
13          )
14  )
15  and length(filter(body.links,
16                    .href_url.domain.root_domain == "evite.com"
17                    and regex.imatch(.href_url.path, '/_ct/[a-f0-9]{40}/')
18             )
19  ) <= 4
20  and not (
21    (subject.is_forward or subject.is_reply)
22    and (length(headers.references) != 0 or headers.in_reply_to is not null)
23    and length(body.previous_threads) > 0
24  )
25  and not (
26    sender.email.domain.root_domain == "evite.com"
27    and coalesce(headers.auth_summary.dmarc.pass, false)
28  )  
29attack_types:
30  - "Credential Phishing"
31tactics_and_techniques:
32  - "Impersonation: Brand"
33  - "Social engineering"
34detection_methods:
35  - "Content analysis"
36  - "Sender analysis"
37id: "9e867a2b-0175-5d8a-b22f-29bfb3ba6a60"