Brand impersonation: Paperless Post

 1name: "Brand impersonation: Paperless Post"
 2description: "Detects messages containing multiple images hosted on ppassets.com (Paperless Post's asset domain) but with fewer than 3 legitimate Paperless Post links, while excluding authentic forwards/replies and messages from verified Paperless Post domains with valid DMARC authentication."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      strings.contains(body.html.raw, 'ppassets.com')
10      and length(filter(html.xpath(body.html, '//img/@src').nodes,
11                        // calling parse_url allows url decoding to help us
12                        strings.parse_url(.raw).domain.root_domain == 'ppassets.com'
13                 )
14      ) >= 1
15      and (
16        length(filter(body.links,
17                      .href_url.domain.domain == "links.paperlesspost.com"
18                      or (
19                        .href_url.domain.root_domain == "paperlesspost.com"
20                        and strings.istarts_with(.href_url.path, '/go/')
21                      )
22               )
23        ) < 2
24        or any(body.links,
25               regex.icontains(.display_text, '(?:view the card|view and reply)')
26               and .href_url.domain.root_domain != "paperlesspost.com"
27        )
28      )
29    )
30    or any(body.links,
31           regex.icontains(.href_url.domain.domain,
32                           'paperless[-_]?(?:post|invit)'
33           )
34           and .href_url.domain.root_domain != "paperlesspost.com"
35    )
36  )
37  and not (
38    (subject.is_forward or subject.is_reply)
39    and (
40      (length(headers.references) != 0 or headers.in_reply_to is not null)
41      or length(body.previous_threads) > 0
42    )
43  )
44  and not (
45    (
46      sender.email.domain.root_domain == "paperlesspost.com"
47      or sender.email.domain.domain == 'paperlesspost.zendesk.com'
48    )
49    and headers.auth_summary.dmarc.pass
50  )  
51attack_types:
52  - "Credential Phishing"
53  - "Malware/Ransomware"
54tactics_and_techniques:
55  - "Impersonation: Brand"
56detection_methods:
57  - "Content analysis"
58  - "Header analysis"
59  - "HTML analysis"
60  - "Sender analysis"
61  - "URL analysis"
62id: "e9ec5e09-e50f-5d02-ad14-35a1a1442960"