Brand impersonation: Punchbowl

 1name: "Brand impersonation: Punchbowl"
 2description: "Detects messages impersonating Punchbowl invitations not originating from legitimate Punchbowl domain."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // Looking for Punchbowl phrasing in all body threads
 8  and (
 9    strings.icontains(body.current_thread.text, "punchbowl")
10    // Look for alt text in HTML for standardized Punchbowl formatting if string is not avail.
11    or strings.icontains(body.html.raw, 'alt="Punchbowl"')
12    // image sourced from punchbowl
13    or any(html.xpath(body.html, '//img/@src').nodes,
14           strings.parse_url(.raw).domain.domain == "static.punchbowl.com"
15           and strings.icontains(strings.parse_url(.raw).path,
16                                 '/invitation',
17                                 '/invite'
18           )
19    )
20  )
21  // Phrasing is typically "You're invited"
22  and (
23    strings.icontains(body.current_thread.text, "you're invited")
24    //
25    // This rule makes use of a beta feature and is subject to change without notice
26    // using the beta feature in custom rules is not suggested until it has been formally released
27    //
28    or (
29      regex.icontains(beta.ocr(file.message_screenshot()).text,
30                      "you're invited",
31                      "open me",
32                      "manage invitation"
33      )
34      and regex.icontains(body.current_thread.text,
35                          'don.t want .{1,40}\?',
36                          '(?:view|open|click|access).{1,10}(?:computer|(?:lap|desk)top)' // instruction to open link on a computer
37      )
38    )
39    or any([
40             html.xpath(body.html,
41                        '//a//img[contains(@src, "btn_open_invitation")]'
42             ).nodes,
43             html.xpath(body.html,
44                        '//a//img[contains(@src, "btn_open_save_the_date")]'
45             ).nodes,
46           ],
47           any(.,
48               regex.icontains(.inner_text,
49                               '(?:open|save).{0,10}(?:invitation|the date)'
50               )
51           )
52    )
53  )
54  // Legitimate sender will be from punchbowl, negating known non-associated domains.
55  and not sender.email.domain.root_domain in ("punchbowl.com", "punchbowl.news")
56  // Capping length to limit FP's
57  and length(body.current_thread.text) < 1500  
58attack_types:
59  - "Credential Phishing"
60tactics_and_techniques:
61  - "Impersonation: Brand"
62  - "Social engineering"
63detection_methods:
64  - "Content analysis"
65  - "Sender analysis"
66id: "58937ba0-6966-559a-bd4f-759ee8b2979e"