Brand impersonation: TikTok

  1name: "Brand impersonation: TikTok"
  2description: "Detects messages impersonating TikTok through similar display names or logo detection, combined with security-themed content and authentication failures. Excludes legitimate TikTok communications and trusted senders."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  and (
  8    // TikTok Brand Detection
  9    (
 10      // display name contains tiktok
 11      strings.ilike(strings.replace_confusables(sender.display_name), '*tiktok*')
 12      // levenshtein distance similar to tiktok
 13      or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
 14                              'tiktok'
 15      ) <= 1
 16      or (
 17        length(ml.logo_detect(file.message_screenshot()).brands) == 1
 18        and any(ml.logo_detect(file.message_screenshot()).brands,
 19                .name == "TikTok" and .confidence == "high"
 20        )
 21      )
 22      // hyphenated sender domain contains a variation of tiktok
 23      or strings.iends_with(sender.email.domain.root_domain,
 24                            "-tiktok.com",
 25                            "badgetiktok.com"
 26      )
 27      or strings.istarts_with(sender.email.domain.root_domain, "tiktokrequest")
 28    )
 29    // OR TikTok verification language
 30    or (
 31      strings.icontains(body.current_thread.text, "tiktok")
 32      and (
 33        strings.icontains(body.current_thread.text, "verified badge")
 34        or strings.icontains(body.current_thread.text, "verification criteria")
 35        or strings.icontains(body.current_thread.text, "activate badge")
 36        or strings.icontains(body.current_thread.text, "verification complete")
 37        or strings.icontains(body.current_thread.text, "almost verified")
 38        or strings.icontains(body.current_thread.text, "review complete")
 39        or strings.icontains(body.current_thread.text, "verify profile")
 40      )
 41    )
 42  )
 43  and (
 44    // ML Topic Analysis and Credential Theft Detection
 45    any(ml.nlu_classifier(body.current_thread.text).topics,
 46        .name in (
 47          "Security and Authentication",
 48          "Secure Message",
 49          "Reminders and Notifications"
 50        )
 51        and .confidence in ("medium", "high")
 52    )
 53    or (
 54      beta.ocr(file.message_screenshot()).text != ""
 55      and any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).topics,
 56              .name in (
 57                "Security and Authentication",
 58                "Secure Message",
 59                "Reminders and Notifications"
 60              )
 61              and .confidence in ("medium", "high")
 62      )
 63    )
 64    or any(ml.nlu_classifier(body.current_thread.text).intents,
 65           .name == "cred_theft" and .confidence == "high"
 66    )
 67    or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
 68           .name == "cred_theft" and .confidence == "high"
 69    )
 70  )
 71  // Not from legitimate TikTok or Google domains with DMARC pass
 72  and not (
 73    sender.email.domain.root_domain in $org_domains
 74    or (
 75      sender.email.domain.root_domain in (
 76        "tiktok.com",
 77        "tiktokglobalshop.com",
 78        "tiktokusds.com",
 79        "bytedance.com",
 80        "tiktokacademy.com",
 81        "webassessor.com" // used for this https://ads.tiktok.com/business/en-US/academy/tiktok-certification
 82      )
 83      and headers.auth_summary.dmarc.pass
 84    )
 85  )
 86  // negate iCloud Private Message Relay
 87  and not (
 88    sender.email.domain.domain == "privaterelay.appleid.com"
 89    or any(headers.hops, any(.fields, .name == "X-ICLOUD-HME"))
 90  )
 91  // negate highly trusted sender domains unless they fail DMARC authentication
 92  and (
 93    (
 94      sender.email.domain.root_domain in $high_trust_sender_root_domains
 95      and not headers.auth_summary.dmarc.pass
 96    )
 97    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
 98  )
 99  and not profile.by_sender().solicited  
100
101attack_types:
102  - "Credential Phishing"
103tactics_and_techniques:
104  - "Impersonation: Brand"
105  - "Social engineering"
106detection_methods:
107  - "Computer Vision"
108  - "Content analysis"
109  - "Header analysis"
110  - "Natural Language Understanding"
111  - "Optical Character Recognition"
112  - "Sender analysis"
113id: "aaacc8b7-fbbd-596d-9268-d90b92bdfcd7"