Brand impersonation: UK government Home Office

  1name: "Brand impersonation: UK government Home Office"
  2description: "Detects messages impersonating UK government agencies (Home Office, UK Visas and Immigration, gov.uk) that contain links not leading to legitimate gov.uk domains or show credential theft language, from senders not authenticated as official government domains."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  
  8  // UK government agencies in display name or subject with homograph protection
  9  and (
 10    any([
 11          strings.replace_confusables(sender.display_name),
 12          strings.replace_confusables(subject.subject)
 13        ],
 14        strings.ilike(.,
 15                      "*sponsorship management system*",
 16                      "*Sponsor Management System*"
 17        )
 18        // exact match of high confidence
 19        or . in~ ("Home Office", "uk home office", "UK Visas and Immigration")
 20    )
 21    // image is srced from the actual home office URL
 22    or strings.icontains(body.html.raw,
 23                         '"https://www.points.homeoffice.gov.uk/gui-sms-jsf/images/'
 24    )
 25    // observed footers in messages
 26    or 2 of (
 27      strings.icontains(body.current_thread.text, '© Crown Copyright '),
 28      strings.icontains(body.current_thread.text, '© 2025 Home Office'),
 29      strings.icontains(body.current_thread.text, '© UK Visas and Immigration'),
 30      regex.icontains(body.current_thread.text, ' [||–-—] Home Office'),
 31      regex.icontains(body.current_thread.text, ' [|–-—] UK Visas and Immigration'),
 32      strings.icontains(body.current_thread.text,
 33                        'This is an automated message from UK Visas and Immigration.'
 34      ),
 35      strings.icontains(body.current_thread.text,
 36                        'This is an automated notification from the Home Office'
 37      ), 
 38      regex.icontains(body.current_thread.text,
 39                        'You(?: are|''re) receiving this notification as a registered SMS user'
 40      ), 
 41      regex.icontains(body.current_thread.text,
 42                        'If you are not the designated.{0,50}SMS user'
 43      ),
 44    )
 45  )
 46  
 47  //  Not from legitimate UK government domains
 48  and not (
 49    sender.email.domain.tld == "gov.uk" and headers.auth_summary.dmarc.pass
 50  )
 51  
 52  // 
 53  and (
 54    // there are links that do not link to "gov.uk"
 55    not all(body.links, .href_url.domain.tld == "gov.uk")
 56    // OR credential theft intent detected  
 57    or any(ml.nlu_classifier(body.current_thread.text).intents,
 58           .name == "cred_theft" and .confidence in ("medium", "high")
 59    )
 60    // link based indicators
 61    or any(body.links,
 62           // suspicious display text
 63           (
 64             .display_text in ("Access SMS", "Login to SMS", "Log in to SMS", "Access UKVI Account")
 65             and .href_url.domain.tld != "gov.uk"
 66           )
 67           // there are mismatched links
 68           or (
 69             .display_url.domain.tld == "gov.uk"
 70             and .href_url.domain.tld != "gov.uk"
 71             and .mismatched
 72           )
 73  
 74           // the path refers to the uk stuff
 75           or (
 76             .href_url.domain.tld != "gov.uk"
 77             and strings.icontains(.href_url.path, 'gov.uk')
 78           )
 79    )
 80  )
 81  
 82  // no previous threads
 83  and not (length(headers.references) > 0 or length(body.previous_threads) > 0)
 84  // negate a high amount of links or newsletters
 85  and not (
 86    length(body.links) > 20
 87    or any(ml.nlu_classifier(body.html.display_text).topics,
 88           .name == "Newsletters and Digests"
 89    )
 90  )
 91  //  High-trust domain exclusion
 92  and (
 93    (
 94      sender.email.domain.root_domain in $high_trust_sender_root_domains
 95      and not headers.auth_summary.dmarc.pass
 96    )
 97    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
 98  )  
 99
100attack_types:
101  - "BEC/Fraud"
102  - "Credential Phishing"
103tactics_and_techniques:
104  - "Impersonation: Brand"
105  - "Social engineering"
106  - "Lookalike domain"
107detection_methods:
108  - "Content analysis"
109  - "Header analysis"
110  - "Natural Language Understanding"
111  - "Sender analysis"
112  - "URL analysis"
113id: "f35d846a-5a72-56a7-9ee7-14cc8899ddff"