Brand impersonation: Partiful

 1name: "Brand impersonation: Partiful"
 2description: "Detects messages impersonating Partiful invitations that retain Partiful-hosted imagery while containing no links back to Partiful."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // Partiful-hosted imagery retained from the genuine invitation template
 8  and any(html.xpath(body.html, '//img/@src').nodes,
 9          // calling parse_url allows url decoding to help us
10          strings.parse_url(.raw).domain.root_domain in (
11            'getpartiful.com',
12            'partiful.com'
13          )
14          or strings.parse_url(.raw).domain.domain == 'partiful-posters.imgix.net'
15  )
16  // a genuine invitation always links back to Partiful; a clone rewrites every href
17  and length(filter(body.links,
18                    .href_url.domain.root_domain in (
19                      'partiful.com',
20                      'getpartiful.com'
21                    )
22             )
23  ) == 0  
24attack_types:
25  - "Credential Phishing"
26tactics_and_techniques:
27  - "Impersonation: Brand"
28  - "Social engineering"
29detection_methods:
30  - "Content analysis"
31  - "HTML analysis"
32  - "URL analysis"
33related_detections:
34  - "brand_impersonation_evite.yml"
35  - "brand_impersonation_paperlesspost.yml"
36  - "brand_impersonation_punchbowl.yml"
37  - "brand_impersonation_greenvelope.yml"
38id: "84d1e029-95a9-5477-9556-41dd525df9d6"