Brand impersonation: MetaMask

 1name: "Brand impersonation: MetaMask"
 2description: "Detects inbound messages containing links where the sender impersonates MetaMask through display name manipulation and includes the MetaMask logo or suspicious language, while not being from legitimate MetaMask domains. The rule checks for credential theft patterns and validates sender authentication."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(body.links) > 0
 8  and (
 9    regex.icontains(strings.replace_confusables(sender.display_name),
10                    '\bmetamask\b',
11                    '\bmetamask\.io\b'
12    )
13    or strings.contains(strings.replace_confusables(sender.display_name),
14                        "METAMASK"
15    )
16    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
17                            'metamask'
18    ) <= 2
19  )
20  and (
21    any(ml.logo_detect(file.message_screenshot()).brands, .name == "MetaMask")
22    or any(ml.nlu_classifier(body.current_thread.text).intents,
23           .name in ("cred_theft", "callback_scam", "steal_pii")
24           and .confidence in ("high")
25    )
26  )
27  and sender.email.domain.root_domain not in~ ('metamask.io')
28  
29  // negate highly trusted sender domains unless they fail DMARC authentication
30  and not (
31    sender.email.domain.root_domain in $high_trust_sender_root_domains
32    and coalesce(headers.auth_summary.dmarc.pass, false)
33  )
34  and not profile.by_sender().any_messages_benign  
35
36attack_types:
37  - "BEC/Fraud"
38  - "Credential Phishing"
39tactics_and_techniques:
40  - "Impersonation: Brand"
41  - "Social engineering"
42detection_methods:
43  - "Computer Vision"
44  - "Natural Language Understanding"
45  - "Sender analysis"
46  - "Header analysis"
47id: "ddb4c618-8ffb-5f01-963e-cd5b69e419b2"