Brand impersonation: Marriott with gift language

 1name: "Brand impersonation: Marriott with gift language"
 2description: "Detects messages impersonating Marriott brand that contain gift-related language such as 'appreciation gift', 'thank you gift', or 'something special' from senders not associated with legitimate Marriott domains."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    strings.icontains(subject.base, "marriott")
 9    or strings.icontains(sender.display_name, "marriott")
10    or strings.ilevenshtein(sender.display_name, 'marriott') <= 2
11  )
12  and any([body.current_thread.text, subject.base],
13          regex.icontains(.,
14                          '(?:appreciation|thank)(?:\s|-)?(you)?\s+gift',
15                          'something special',
16                          'special.{0,10}thank(?:\s|-)you'
17          )
18  )
19  and not (
20    sender.email.domain.root_domain in~ (
21      "marriott.com",
22      "res-marriott.com",
23      "email-marriott.com",
24      "feedback-marriott.com",
25      "marriotthotels.se",
26      "bookonline.com"
27    )
28    and coalesce(headers.auth_summary.dmarc.pass, false)
29  )  
30attack_types:
31  - "Credential Phishing"
32tactics_and_techniques:
33  - "Impersonation: Brand"
34  - "Social engineering"
35detection_methods:
36  - "Content analysis"
37  - "Header analysis"
38  - "Sender analysis"
39id: "39b32b97-80bc-5033-902e-312377cab6e2"