Brand impersonation: SoFi

 1name: "Brand impersonation: SoFi"
 2description: "Detects messages impersonating SoFi by analyzing sender display name, domain, body content including specific address references and phone numbers, while excluding legitimate SoFi communications with proper DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // standard brand template
 8  and (
 9    // disclaimer
10    (
11      regex.icontains(body.current_thread.text,
12                      '\bsofi (?:bank|invest|securities|team|tech|wealth)\b'
13      )
14      and regex.icontains(body.current_thread.text,
15                          '©.20[0-9]{2}.(?:sofi|social finance)'
16      )
17      // phone numbers
18      and regex.icontains(body.current_thread.text,
19                          '\(855\)[\s\-\.]456[\s\-\.]7634',
20                          '\(844\)[\s\-\.]908[\s\-\.]7634'
21      )
22    )
23  
24    // address
25    or (
26      regex.icontains(body.current_thread.text, '\bsofi\b')
27      and strings.icontains(body.current_thread.text, "2750 E Cottonwood Pkwy")
28      and strings.icontains(body.current_thread.text, "Salt Lake City, UT 84121")
29    )
30  
31    // observed cred theft ttp
32    or (
33      regex.icontains(sender.display_name, '\bsofi\b')
34      and strings.icontains(body.current_thread.text,
35                            "trade confirmation",
36                            "self-directed investing account"
37      )
38    )
39  )
40  
41  // negate legitimate replies
42  and not (
43    (length(headers.references) > 0 or headers.in_reply_to is not null)
44    and (subject.is_forward or subject.is_reply)
45    and length(body.previous_threads) >= 1
46  )
47  
48  // topic negations
49  and not any(ml.nlu_classifier(body.current_thread.text).topics,
50              .name in ("Newsletters and Digests")
51  )
52  
53  // negate sofi & related domains
54  and not (
55    sender.email.domain.root_domain in (
56      "sofi.com", // parent domain
57      "sofi.org", // observed sender domain
58      "samsung.com", // financial partnership
59      "investordelivery.com" // financials delivery platform
60    )
61    and coalesce(headers.auth_summary.dmarc.pass, false)
62  )
63  
64  // negate high trust sender root domains unless they fail authentication
65  and not (
66    sender.email.domain.root_domain in $high_trust_sender_root_domains
67    and coalesce(headers.auth_summary.dmarc.pass, false)
68  )  
69attack_types:
70  - "Credential Phishing"
71tactics_and_techniques:
72  - "Impersonation: Brand"
73  - "Social engineering"
74detection_methods:
75  - "Content analysis"
76  - "Header analysis"
77  - "Sender analysis"
78  - "Natural Language Understanding"
79  - "URL analysis"
80id: "a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d"