Brand impersonation: Squarespace

 1name: "Brand impersonation: Squarespace"
 2description: "Detects impersonation of Squarespace through sender display name or subject line similarity, where the sender is not from legitimate Squarespace domains or fails authentication checks."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    strings.icontains(sender.display_name, "squarespace")
 9    or strings.ilevenshtein(sender.display_name, "squarespace") < 2
10    or regex.icontains(sender.display_name,
11                       's\x{206E}+q\x{206E}+u\x{206E}+a\x{206E}+r\x{206E}+e\x{206E}+s\x{206E}+p\x{206E}+a\x{206E}+c\x{206E}+e'
12    )
13  )
14  // and the sender is not in org_domains or from Squarespace domains and passes auth
15  and not (
16    sender.email.domain.root_domain in $org_domains
17    or (
18      sender.email.domain.root_domain in (
19        "squarespace.com",
20        "squarespace.info",
21        "shipstation.com"
22      )
23      and headers.auth_summary.dmarc.pass
24    )
25  )
26  // negate highly trusted sender domains unless they fail DMARC authentication
27  and not (
28    sender.email.domain.root_domain in $high_trust_sender_root_domains
29    and coalesce(headers.auth_summary.dmarc.pass, false)
30  )  
31
32attack_types:
33  - "Credential Phishing"
34tactics_and_techniques:
35  - "Impersonation: Brand"
36  - "Social engineering"
37detection_methods:
38  - "Header analysis"
39  - "Sender analysis"
40id: "f806de6f-aad5-52e4-a3a3-6fb97ceab376"