Brand impersonation: Google Authenticator

calendar Oct 2, 2026  ·
Share on: linkedin copy

Detects inbound messages where the sender name claims to be Google Authenticator, but the sending domain is not associated with Google or Okta and fails DMARC authentication, indicating a likely impersonation of the two-factor authentication service.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Google Authenticator"
 2description: "Detects inbound messages where the sender name claims to be Google Authenticator, but the sending domain is not associated with Google or Okta and fails DMARC authentication, indicating a likely impersonation of the two-factor authentication service."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(ml.nlu_classifier(body.current_thread.text).entities,
 8          .name == "sender" and strings.icontains(.text, "Google Authenticator")
 9  )
10  and not (
11    sender.email.domain.root_domain in ("google.com", "okta.com")
12    and coalesce(headers.auth_summary.dmarc.pass, false)
13  )  
14attack_types:
15  - "Credential Phishing"
16  - "BEC/Fraud"
17tactics_and_techniques:
18  - "Impersonation: Brand"
19  - "Spoofing"
20detection_methods:
21  - "Natural Language Understanding"
22  - "Header analysis"
23  - "Sender analysis"
24id: "ee4b6a17-7424-57c8-9499-7bc21eef8dd4"
to-top