Brand impersonation: Mailchimp

 1name: "Brand impersonation: Mailchimp"
 2description: "Detects messages from senders impersonating Mailchimp through display name spoofing or brand logo usage, combined with security-themed content and suspicious authentication patterns."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    // display name contains Mailchimp
 9    (
10      strings.ilike(strings.replace_confusables(sender.display_name),
11                    '*mailchimp*'
12      )
13      // levenshtein distance similar to Mailchimp
14      or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
15                              'mailchimp'
16      ) <= 1
17      or any(ml.logo_detect(file.message_screenshot()).brands,
18             .name == "MailChimp" and .confidence == "high"
19      )
20    )
21  )
22  and (
23    any(ml.nlu_classifier(body.current_thread.text).topics,
24        .name in (
25          "Security and Authentication",
26          "Secure Message",
27          "Reminders and Notifications"
28        )
29        and .confidence in ("medium", "high")
30    )
31    or (
32      beta.ocr(file.message_screenshot()).text != ""
33      and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
34              .name in (
35                "Security and Authentication",
36                "Secure Message",
37                "Reminders and Notifications"
38              )
39              and .confidence in ("medium", "high")
40      )
41    )
42    or any(ml.nlu_classifier(body.current_thread.text).intents,
43           .name == "cred_theft" and .confidence == "high"
44    )
45    or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
46           .name == "cred_theft" and .confidence == "high"
47    )
48  )
49  
50  // and the sender is not in org_domains or from Mailchimp domains and passes auth
51  and not (
52    sender.email.domain.root_domain in $org_domains
53    or (
54      sender.email.domain.root_domain in ("intuit.com", "mailchimp.com")
55      and headers.auth_summary.dmarc.pass
56    )
57  )
58  and not strings.ends_with(headers.message_id, ".mailchimp.com>")
59  // and the sender is not from high trust sender root domains
60  and (
61    (
62      sender.email.domain.root_domain in $high_trust_sender_root_domains
63      and not headers.auth_summary.dmarc.pass
64    )
65    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
66  )
67  and not profile.by_sender().solicited
68    
69
70attack_types:
71  - "Credential Phishing"
72tactics_and_techniques:
73  - "Impersonation: Brand"
74  - "Social engineering"
75detection_methods:
76  - "Computer Vision"
77  - "Natural Language Understanding"
78  - "Content analysis"
79  - "Header analysis"
80  - "Sender analysis"
81id: "48b454c7-fcd7-54d4-b460-5dfec2c1a3e2"