Brand impersonation: Canada Revenue Agency

 1name: "Brand impersonation: Canada Revenue Agency"
 2description: "Detects messages impersonating the Canada Revenue Agency (CRA) in English or French that contain credential theft indicators. The rule identifies senders claiming to be CRA through display names or subject line references, uses natural language understanding to detect credential theft intent, and excludes legitimate senders with proper authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    // cred theft
 9    any(ml.nlu_classifier(body.current_thread.text).intents,
10        .name == "cred_theft" and .confidence != 'low'
11    )
12    // contains a link not to the domain "canda.ca"
13    or any(body.current_thread.links,
14           .href_url.domain.root_domain not in ('canada.ca')
15    )
16    // contains any attachment that isn't an image
17    or any(attachments, .file_type not in $file_types_images)
18  )
19
20  // sender claims to be CRA
21  and (
22    strings.icontains(sender.display_name,
23                      'canada revenue agency',
24                      'agence du revenu du canada'
25    )
26    or (
27      regex.icontains(sender.display_name, '\bcra\b')
28      // limit it to samples that mention CRA by name in the body
29      and regex.icontains(body.current_thread.text,
30                          '(?:canada revenue|revenu du canada)'
31      )
32    )
33  )
34
35  // not a high trust or cra-arc.gc.ca
36  and not (
37    (
38      // negate highly trusted sender domains
39      sender.email.domain.root_domain in $high_trust_sender_root_domains
40      // negate legit senders from legitimate cra
41      or sender.email.domain.root_domain == "cra-arc.gc.ca"
42    )
43    // enforce authentication
44    and coalesce(headers.auth_summary.dmarc.pass, false)
45  )  
46attack_types:
47  - "BEC/Fraud"
48  - "Credential Phishing"
49tactics_and_techniques:
50  - "Impersonation: Brand"
51  - "Social engineering"
52detection_methods:
53  - "Content analysis"
54  - "Header analysis"
55  - "Sender analysis"
56id: "72607c4c-52dc-5df6-b547-54ee321b7a7a"