Brand impersonation: Internal Revenue Service

  1name: "Brand impersonation: Internal Revenue Service"
  2description: "Detects messages from senders posing as the Internal Revenue Service by checking display name similarity and content indicators from body text and screenshots. Excludes legitimate IRS domains and authenticated senders."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and (
  8    // display name contains IRS
  9    (
 10      strings.ilike(strings.replace_confusables(sender.display_name),
 11                    '*internal revenue service*'
 12      )
 13      or strings.like(strings.replace_confusables(sender.display_name), 'IRS*')
 14      or regex.icontains(strings.replace_confusables(sender.display_name),
 15                         'internal.{0,5}revenue.{0,5}service'
 16      )
 17    )
 18  
 19    // levenshtein distance similar to IRS
 20    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
 21                            'internal revenue service'
 22    ) <= 1
 23    or (
 24      strings.like(strings.replace_confusables(subject.base), '*IRS*')
 25      and any(ml.nlu_classifier(body.current_thread.text).topics,
 26              .name == "Government Services" and .confidence != "low"
 27      )
 28    )
 29    or 2 of (
 30      strings.icontains(body.current_thread.text, "Internal Revenue Service"),
 31      strings.icontains(body.current_thread.text, "4228 Park Ave S"),
 32      strings.icontains(body.current_thread.text, "1111 Constitution Ave"),
 33      strings.icontains(body.current_thread.text, "New York, New York 10003"),
 34      strings.icontains(body.current_thread.text, "Washington, DC 20224")
 35    )
 36    or regex.icontains(body.current_thread.text,
 37                       '©\s*20[0-9]{2}\s*\s*Internal Revenue Service'
 38    )
 39  )
 40  and (
 41    (
 42      any(ml.nlu_classifier(body.current_thread.text).topics,
 43          .name in ("Security and Authentication", "Financial Communications")
 44          and .confidence == "high"
 45      )
 46      and not any(ml.nlu_classifier(body.current_thread.text).topics,
 47                  .name in (
 48                    "Advertising and Promotions",
 49                    "Newsletters and Digests",
 50                    "Political Mail",
 51                    "Events and Webinars"
 52                  )
 53                  and .confidence != "low"
 54      )
 55    )
 56    or (
 57      // OCR length is more than 2x the current_thread length
 58      // indicating that the body is mostly an image
 59      (
 60        (length(beta.ocr(file.message_screenshot()).text) + 0.0) / (
 61          length(body.current_thread.text) + 0.0
 62        )
 63      ) > 2
 64      and length(body.previous_threads) == 0
 65      and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
 66              .name in ("Security and Authentication", "Financial Communications")
 67              and .confidence == "high"
 68      )
 69      and not any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
 70                  .name in (
 71                    "Advertising and Promotions",
 72                    "Newsletters and Digests",
 73                    "Political Mail",
 74                    "Events and Webinars"
 75                  )
 76                  and .confidence != "low"
 77      )
 78    )
 79    or any(ml.nlu_classifier(body.current_thread.text).intents,
 80           .name == "cred_theft" and .confidence == "high"
 81    )
 82    or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
 83           .name == "cred_theft" and .confidence == "high"
 84    )
 85  )
 86  and not (
 87    (
 88      length(body.current_thread.text) > 2500
 89      or any(headers.hops,
 90             any(.fields,
 91                 .name == 'List-Unsubscribe-Post'
 92                 and .value == 'List-Unsubscribe=One-Click'
 93             )
 94      )
 95    )
 96    and any(ml.nlu_classifier(body.current_thread.text).intents,
 97            .name == "benign" and .confidence == "high"
 98    )
 99  )
100  
101  // and the sender is not in org_domains or from .gov domains and passes auth
102  and not (
103    sender.email.domain.root_domain in $org_domains
104    or (
105      (
106        sender.email.domain.root_domain in ("govdelivery.com", "ms-cpa.org")
107        or sender.email.domain.tld == "gov"
108      )
109      and headers.auth_summary.dmarc.pass
110    )
111  )
112  // and the sender is not from high trust sender root domains
113  and not (
114    sender.email.domain.root_domain in $high_trust_sender_root_domains
115    and coalesce(headers.auth_summary.dmarc.pass, false)
116  )  
117
118attack_types:
119  - "BEC/Fraud"
120  - "Credential Phishing"
121tactics_and_techniques:
122  - "Impersonation: Brand"
123  - "Social engineering"
124detection_methods:
125  - "Content analysis"
126  - "Natural Language Understanding"
127  - "Optical Character Recognition"
128  - "Sender analysis"
129id: "3c63f8e9-4bce-5ce3-b17d-1ae361b5782d"