Brand impersonation: MetaMask

 1name: "Brand impersonation: MetaMask"
 2description: "Detects inbound messages containing links where the sender impersonates MetaMask through display name manipulation and includes the MetaMask logo or suspicious language, while not being from legitimate MetaMask domains. The rule checks for credential theft patterns and validates sender authentication."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(body.links) > 0
 8  and (
 9    regex.icontains(strings.replace_confusables(sender.display_name),
10                    '\bmetamask\b',
11                    '\bmetamask\.io\b'
12    )
13    or strings.contains(strings.replace_confusables(sender.display_name),
14                        "METAMASK"
15    )
16    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
17                            'metamask'
18    ) <= 2
19  )
20  and (
21    any(ml.logo_detect(beta.message_screenshot()).brands, .name == "MetaMask")
22    or any(ml.nlu_classifier(body.current_thread.text).intents,
23           .name in ("cred_theft", "callback_scam", "steal_pii")
24           and .confidence in ("high")
25    )
26  )
27  and sender.email.domain.root_domain not in~ ('metamask.io')
28  
29  // negate highly trusted sender domains unless they fail DMARC authentication
30  and (
31    (
32      sender.email.domain.root_domain in $high_trust_sender_root_domains
33      and not headers.auth_summary.dmarc.pass
34    )
35    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
36  )
37  and not profile.by_sender().any_messages_benign  
38
39attack_types:
40  - "BEC/Fraud"
41  - "Credential Phishing"
42tactics_and_techniques:
43  - "Impersonation: Brand"
44  - "Social engineering"
45detection_methods:
46  - "Computer Vision"
47  - "Natural Language Understanding"
48  - "Sender analysis"
49  - "Header analysis"
50id: "ddb4c618-8ffb-5f01-963e-cd5b69e419b2"