Brand impersonation: Amazon

  1name: "Brand impersonation: Amazon"
  2description: |
  3  Impersonation of Amazon. These are most commonly fake shipping notifications.
  4  Amazon is the #2 most-impersonated brand (as of Q2 2020)  
  5references:
  6  - "https://www.pcmag.com/news/google-and-amazon-are-impersonated-the-most-in-phishing-scams"
  7  - "https://sellercentral.amazon.com/gp/help/external/32261?language=en-US"
  8type: "rule"
  9severity: "low"
 10source: |
 11  type.inbound
 12  and not any(headers.hops,
 13              any(.fields,
 14                  .name == 'X-Amazon-Mail-Relay-Type' and .value == "notification"
 15              )
 16  )
 17  and (
 18    regex.icontains(sender.display_name,
 19                    '\b[aaa𝝰aａ𝑎𝗮𝕒𝖆𝓪𝚊𝞪аɑα𝔞𝒂𝘢𝛂⍺𝒶𝙖𝜶𝛼𝐚𝖺]maz[o0]n\s?(pay|marketplace|\.com)|ᵃ⤻ᶻ'
 20    )
 21    or strings.ilevenshtein(sender.display_name, 'amazon.com') <= 1
 22    or strings.ilevenshtein(sender.display_name, 'amazon pay') <= 1
 23    or strings.ilevenshtein(sender.display_name, 'amazon marketplace') <= 1
 24    or strings.ilevenshtein(sender.display_name, 'amazon customer support') <= 1
 25    or regex.icontains(sender.display_name,
 26                       "prime (?:subscription|notification|support)"
 27    )
 28    or regex.imatch(sender.display_name,
 29                    '^(?:amazon\s)?prime (?:deals?|store)$',
 30                    'amazon'
 31    )
 32    or strings.ilike(subject.subject, "*prime membership*")
 33    // prime subscription id ##
 34    or (
 35      strings.icontains(subject.base, "prime")
 36      and regex.icontains(body.current_thread.text, 'subscription\s+id\s?.\s\w+')
 37    )
 38    or (
 39      strings.ilevenshtein(sender.display_name, 'amazon') <= 1
 40      and sender.email.domain.root_domain in $free_email_providers
 41    )
 42    or (
 43      any(ml.nlu_classifier(body.current_thread.text).intents,
 44          .name == "cred_theft" and .confidence == "high"
 45      )
 46      and any(ml.nlu_classifier(body.current_thread.text).topics,
 47              .name in (
 48                "Security and Authentication",
 49                "Secure Message",
 50                "Reminders and Notifications",
 51                "Order Confirmations",
 52                "Customer Service and Support"
 53              )
 54      )
 55      and strings.icontains(body.current_thread.text, "amazon")
 56    )
 57  )
 58  // negate listservs
 59  and not (
 60    any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
 61    and strings.contains(sender.display_name, "via")
 62  )
 63  and sender.email.domain.root_domain not in~ (
 64    'amazon.com',
 65    'amazon.com.au',
 66    'amazon.de',
 67    'amazon.es',
 68    'amazon.fr',
 69    'amazon.it',
 70    'amazon.in',
 71    'amazon.lu',
 72    'amazon.nl',
 73    'amazonsellerservices.com',
 74    'amazon.ae',
 75    'amazon.sa',
 76    'amazon.com.sg',
 77    'amazon.co.uk',
 78    'amazon.co.jp',
 79    'amazon.com.mx',
 80    'amazon.com.br',
 81    'amazon.com.tr',
 82    'amazon.cn',
 83    'amazon.ca',
 84    'amazon.sg',
 85    'amazonaws.cn',
 86    'amazonpay.in',
 87    'amazonpay.com',
 88    'q4inc.com',
 89    'synchronybank.com',
 90    'opodo.com',
 91    'flynas.com',
 92    'amazonmusic.com',
 93    'blink.com',
 94    'affirm.com',
 95    'amazon.work',
 96    'amazon.jobs',
 97    'rocketmoney.com',
 98    'registrar.amazon',
 99    'amazonworkspaces.com',
100    'awsapps.com',
101    'aws.com',
102    'awsevents.com',
103    'amazon.se',
104    'amazon.ie',
105    'amazonconnect.com',
106    'aws-experience.com',
107    'proofpointessentials.com',
108    'area1security.com',
109    'marketplace.aws',
110    'quicksight.aws'
111  )
112  
113  // negate amazon.com.be explicitly, this cannot be part of the root_domain set above as it uses the PSL (Public suffix list) for parsing and com.be is owned by amazon directly.
114  and sender.email.domain.domain not in~ ('amazon.com.be')
115  and sender.email.email not in $recipient_emails
116  and sender.email.domain.domain not in $org_domains
117  
118  // negate highly trusted sender domains unless they fail DMARC authentication
119  and (
120    (
121      sender.email.domain.root_domain in $high_trust_sender_root_domains
122      and not headers.auth_summary.dmarc.pass
123    )
124    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
125  )  
126
127attack_types:
128  - "Credential Phishing"
129tactics_and_techniques:
130  - "Impersonation: Brand"
131  - "Social engineering"
132detection_methods:
133  - "Header analysis"
134  - "Sender analysis"
135id: "13fc967d-4cc6-501d-9637-8c0761a1a354"