Brand impersonation: Squarespace

 1name: "Brand impersonation: Squarespace"
 2description: "Detects impersonation of Squarespace through sender display name or subject line similarity, where the sender is not from legitimate Squarespace domains or fails authentication checks."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    strings.icontains(strings.replace_confusables(sender.display_name),
 9                      "squarespace"
10    )
11    or strings.ilevenshtein(sender.display_name, "squarespace") < 2
12    or regex.icontains(sender.display_name,
13                       's\x{206E}+q\x{206E}+u\x{206E}+a\x{206E}+r\x{206E}+e\x{206E}+s\x{206E}+p\x{206E}+a\x{206E}+c\x{206E}+e'
14    )
15  )
16  // and the sender is not in org_domains or from Squarespace domains and passes auth
17  and not (
18    sender.email.domain.root_domain in $org_domains
19    or (
20      sender.email.domain.root_domain in (
21        "squarespace.com",
22        "squarespace.info",
23        "shipstation.com"
24      )
25      and headers.auth_summary.dmarc.pass
26    )
27  )
28  // negate highly trusted sender domains unless they fail DMARC authentication
29  and not (
30    sender.email.domain.root_domain in $high_trust_sender_root_domains
31    and coalesce(headers.auth_summary.dmarc.pass, false)
32  )  
33
34attack_types:
35  - "Credential Phishing"
36tactics_and_techniques:
37  - "Impersonation: Brand"
38  - "Social engineering"
39detection_methods:
40  - "Header analysis"
41  - "Sender analysis"
42id: "f806de6f-aad5-52e4-a3a3-6fb97ceab376"