Brand impersonation: State Farm

 1name: "Brand impersonation: State Farm"
 2description: "Detects messages impersonating State Farm insurance company through display name spoofing or similar variations, excluding legitimate communications from verified State Farm domains with proper DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      regex.icontains(sender.display_name, 'state\s?farm')
10      and not (
11        strings.icontains(sender.display_name, "state farm")
12        and strings.icontains(sender.display_name,
13                              "center",
14                              "arena",
15                              "stadium",
16                              "hall",
17                              "classic",
18                              "showdown",
19                              "perks at work"
20        )
21      )
22    )
23    or (
24      any(ml.nlu_classifier(body.current_thread.text).entities,
25          .name == "org" and regex.imatch(.text, 'state farm')
26      )
27      and strings.icontains(body.current_thread.text,
28                            'short survey',
29                            'loyalty program'
30      )
31    )
32  )
33  
34  // and the sender is not in org_domains or from State Farm domains
35  and not (
36    sender.email.domain.valid
37    and (
38      sender.email.domain.root_domain in $org_domains
39      or sender.email.domain.root_domain in $high_trust_sender_root_domains
40      or sender.email.domain.root_domain in (
41        "statefarm.com",
42        "statefarminsurance.com",
43        "statefarm.ca",
44        "statefarmbank.com",
45        "sfauthentication.com",
46        "statefarmarena.com",
47        "statefarmservice.com",
48        "statefarmisthere.com",
49        "digitalpayouts.com", // State Farm use this domain for claim payouts
50        "aravo.com", // risk management company State Farm uses
51        "statefarmclaims.com",
52        "statefarmfeedback.com", // legit survey
53        "statefarmsurveys.com", // legit survey
54        "nationalesurvey.com",
55        "sfdividend.com" // dividend payout email from State Farm
56      )
57    )
58  )
59  // negate highly trusted sender domains unless they fail DMARC authentication
60  and not (
61    sender.email.domain.root_domain in $high_trust_sender_root_domains
62    and coalesce(headers.auth_summary.dmarc.pass, false)
63  )  
64
65attack_types:
66  - "Credential Phishing"
67tactics_and_techniques:
68  - "Impersonation: Brand"
69  - "Social engineering"
70  - "Spoofing"
71detection_methods:
72  - "Header analysis"
73  - "Sender analysis"
74id: "bcf7eba0-ac94-52c7-81b3-5abd8019f564"