Brand impersonation: UK government Home Office

  1name: "Brand impersonation: UK government Home Office"
  2description: "Detects messages impersonating UK government agencies (Home Office, UK Visas and Immigration, gov.uk) that contain links not leading to legitimate gov.uk domains or show credential theft language, from senders not authenticated as official government domains."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  
  8  // UK government agencies in display name or subject with homograph protection
  9  and (
 10    any([
 11          strings.replace_confusables(sender.display_name),
 12          strings.replace_confusables(subject.subject)
 13        ],
 14        strings.ilike(.,
 15                      "*sponsorship management system*",
 16                      "*Sponsor Management System*"
 17        )
 18        // exact match of high confidence
 19        or . in~ ("Home Office", "uk home office", "UK Visas and Immigration")
 20    )
 21    // image is srced from the actual home office URL
 22    or strings.icontains(body.html.raw,
 23                         '"https://www.points.homeoffice.gov.uk/gui-sms-jsf/images/'
 24    )
 25    // observed footers in messages
 26    or 2 of (
 27      strings.icontains(body.current_thread.text, '© Crown Copyright '),
 28      strings.icontains(body.current_thread.text, '© 2025 Home Office'),
 29      strings.icontains(body.current_thread.text, '© UK Visas and Immigration'),
 30      regex.icontains(body.current_thread.text, ' [||–-—] Home Office'),
 31      regex.icontains(body.current_thread.text,
 32                      ' [|–-—] UK Visas and Immigration'
 33      ),
 34      strings.icontains(body.current_thread.text,
 35                        'This is an automated message from UK Visas and Immigration.'
 36      ),
 37      strings.icontains(body.current_thread.text,
 38                        'This is an automated notification from the Home Office'
 39      ),
 40      regex.icontains(body.current_thread.text,
 41                      'You(?: are|''re) receiving this notification as a registered SMS user'
 42      ),
 43      regex.icontains(body.current_thread.text,
 44                      'If you are not the designated.{0,50}SMS user'
 45      ),
 46    )
 47  )
 48  
 49  //  Not from legitimate UK government domains
 50  and not (
 51    sender.email.domain.tld == "gov.uk" and headers.auth_summary.dmarc.pass
 52  )
 53  
 54  // 
 55  and (
 56    // there are links that do not link to "gov.uk"
 57    not all(body.links, .href_url.domain.tld == "gov.uk")
 58    // OR credential theft intent detected  
 59    or any(ml.nlu_classifier(body.current_thread.text).intents,
 60           .name == "cred_theft" and .confidence in ("medium", "high")
 61    )
 62    // link based indicators
 63    or any(body.links,
 64           // suspicious display text
 65           (
 66             .display_text in (
 67               "Access SMS",
 68               "Login to SMS",
 69               "Log in to SMS",
 70               "Access UKVI Account"
 71             )
 72             and .href_url.domain.tld != "gov.uk"
 73           )
 74           // there are mismatched links
 75           or (
 76             .display_url.domain.tld == "gov.uk"
 77             and .href_url.domain.tld != "gov.uk"
 78             and .mismatched
 79           )
 80  
 81           // the path refers to the uk stuff
 82           or (
 83             .href_url.domain.tld != "gov.uk"
 84             and strings.icontains(.href_url.path, 'gov.uk')
 85           )
 86    )
 87  )
 88  
 89  // no previous threads
 90  and not (length(headers.references) > 0 or length(body.previous_threads) > 0)
 91  // negate a high amount of links or newsletters
 92  and not (
 93    length(body.links) > 20
 94    or any(ml.nlu_classifier(body.html.display_text).topics,
 95           .name == "Newsletters and Digests"
 96    )
 97  )
 98  //  High-trust domain exclusion
 99  and (
100    (
101      sender.email.domain.root_domain in $high_trust_sender_root_domains
102      and not headers.auth_summary.dmarc.pass
103    )
104    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
105  )  
106attack_types:
107  - "BEC/Fraud"
108  - "Credential Phishing"
109tactics_and_techniques:
110  - "Impersonation: Brand"
111  - "Social engineering"
112  - "Lookalike domain"
113detection_methods:
114  - "Content analysis"
115  - "Header analysis"
116  - "Natural Language Understanding"
117  - "Sender analysis"
118  - "URL analysis"
119id: "f35d846a-5a72-56a7-9ee7-14cc8899ddff"