Brand impersonation: Greetings Island

 1name: "Brand impersonation: Greetings Island"
 2description: "Detects messages that impersonate the e-vite service Greetings Island by referencing its branding, copyright footer, or logo."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and (
 8    // contains assets hosted on Greetings Island's CDN
 9    (
10      strings.contains(body.html.raw, 'greetingsisland.com')
11      and any(html.xpath(body.html, '//img/@src').nodes,
12              strings.parse_url(.raw).domain.root_domain == "greetingsisland.com"
13      )
14    )
15    // copyright footer
16    or regex.icontains(body.current_thread.text,
17                       '(?:©|\(c\)|copyright)\s*greetings\s?island'
18    )
19    // Greetings Island logo present in message screenshot
20    or (
21      any(ml.logo_detect(file.message_screenshot()).brands,
22          .name == "Invite Company" and .confidence != "low"
23      )
24      // "Invite Company" matches many different e-vite provider logos
25      // we want to filter this to greetings island specifically
26      and (
27        regex.icontains(body.current_thread.text, 'greetings\s?island')
28        //
29        // This rule makes use of a beta feature and is subject to change without notice
30        // using the beta feature in custom rules is not suggested until it has been formally released
31        //
32        or regex.icontains(beta.ocr(file.message_screenshot()).text,
33                           'greetings\s?island'
34        )
35      )
36    )
37  )
38  
39  // not from Greetings Island actual
40  and not (
41    sender.email.domain.root_domain == "greetingsisland.com"
42    and coalesce(headers.auth_summary.dmarc.pass, false)
43  )
44  
45  // negate replies and forwards
46  and not (
47    (subject.is_forward or subject.is_reply)
48    and (length(headers.references) != 0 or headers.in_reply_to is not null)
49    and length(body.previous_threads) > 0
50  )  
51attack_types:
52  - "Credential Phishing"
53  - "Malware/Ransomware"
54tactics_and_techniques:
55  - "Impersonation: Brand"
56  - "Social engineering"
57  - "Image as content"
58  - "Spoofing"
59detection_methods:
60  - "Content analysis"
61  - "Computer Vision"
62  - "Optical Character Recognition"
63  - "Header analysis"
64  - "HTML analysis"
65  - "Sender analysis"
66id: "c859e338-be3b-522d-956a-289de226d7a5"