Brand impersonation: Robinhood

  1name: "Brand impersonation: Robinhood"
  2description: "Detects messages impersonating Robinhood by analyzing sender display name, domain, body content including specific address references, and social media links, while excluding legitimate Robinhood communications with proper DMARC authentication."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  and (
  8    (
  9      any(ml.nlu_classifier(body.current_thread.text).entities,
 10          .name in ("org", "sender") and strings.icontains(.text, 'Robinhood')
 11      )
 12      and (
 13        any(ml.nlu_classifier(body.current_thread.text).intents,
 14            .name == "callback_scam" and .confidence != "low"
 15        )
 16      )
 17    )
 18    or strings.icontains(body.current_thread.text, 'The Robinhood Team')
 19    or strings.icontains(body.current_thread.text, 'robinhood automated message')
 20    or regex.icontains(body.current_thread.text, '©\s*20[0-9]{2}\s*\s*Robinhood')
 21    or regex.icontains(body.current_thread.text,
 22                       '(?:\+?\d{0,2}[\s\-\.]*)?(?:\(?888\)?)[\s\-\.]*344[\s\-\.]*3957'
 23    )
 24    or regex.icontains(body.current_thread.text,
 25                       'brokerage clearing (?:service|company|business)'
 26    )
 27    or regex.icontains(body.html.raw, 'new passkey was recently added')
 28    or 2 of (
 29      strings.icontains(body.current_thread.text, "Robinhood"),
 30      regex.icontains(body.current_thread.text, '42 Willow (?:Road|St)'),
 31      strings.icontains(body.current_thread.text, "Menlo Park, CA 97095")
 32    )
 33    or (
 34      strings.icontains(sender.display_name, 'Robinhood')
 35      and (
 36        3 of (
 37          regex.icontains(body.current_thread.text, 'Location:?'),
 38          regex.icontains(body.current_thread.text, 'Time:'),
 39          regex.icontains(body.current_thread.text, 'Device:?'),
 40          regex.icontains(body.current_thread.text, 'IP Address:?'),
 41          regex.icontains(body.current_thread.text, 'Date:'),
 42          regex.icontains(body.current_thread.text, 'Region:?'),
 43          regex.icontains(body.current_thread.text, 'App:?'),
 44          regex.icontains(body.current_thread.text, 'Email ID:?')
 45        )
 46        or strings.icontains(body.current_thread.text, "new passkey added")
 47        or strings.icontains(body.current_thread.text,
 48                             "Security support phone number"
 49        )
 50      )
 51    )
 52    or (
 53      length(filter(body.links,
 54                    strings.icontains(.href_url.url,
 55                                      'https://www.facebook.com/robinhood'
 56                    )
 57                    or strings.icontains(.href_url.url,
 58                                         'https://twitter.com/robinhoodapp'
 59                    )
 60                    or strings.icontains(.href_url.url,
 61                                         'https://www.youtube.com/@RobinhoodApp'
 62                    )
 63                    or strings.icontains(.href_url.url,
 64                                         'https://www.instagram.com/robinhood'
 65                    )
 66             )
 67      ) >= 2
 68    )
 69  )
 70  // negate legitimate replies and forwards
 71  and (
 72    (
 73      (length(headers.references) > 0 or headers.in_reply_to is null)
 74      and not (subject.is_reply or subject.is_forward)
 75    )
 76    or length(headers.references) == 0
 77  )
 78  // negate newsletters and webinars
 79  and not any(ml.nlu_classifier(body.current_thread.text).topics,
 80              .name in (
 81                "Newsletters and Digests",
 82                "Health and Wellness",
 83                "Events and Webinars"
 84              )
 85              and .confidence == "high"
 86  )
 87  and not any(ml.nlu_classifier(body.current_thread.text).intents,
 88              .name == "benign" and .confidence == "high"
 89  )
 90  and not (
 91    sender.email.domain.root_domain in (
 92      "robinhood.com",
 93      "robinhood.org",
 94      "duck.com", // unrelated domain
 95      "robinhoodauctions.com", // unrelated domain
 96      "bitstamp.net", // robinhood acquisition
 97      "sinch.com" // unrelated domain
 98    )
 99    and coalesce(headers.auth_summary.dmarc.pass, false)
100  )  
101attack_types:
102  - "Credential Phishing"
103tactics_and_techniques:
104  - "Impersonation: Brand"
105  - "Social engineering"
106detection_methods:
107  - "Content analysis"
108  - "Header analysis"
109  - "Sender analysis"
110  - "URL analysis"
111id: "7c8eca19-63ac-5cd3-a92b-4fb34b526683"