Brand impersonation: Amazon
Impersonation of Amazon. These are most commonly fake shipping notifications. Amazon is the #2 most-impersonated brand (as of Q2 2020)
Sublime rule (View on GitHub)
1name: "Brand impersonation: Amazon"
2description: |
3 Impersonation of Amazon. These are most commonly fake shipping notifications.
4 Amazon is the #2 most-impersonated brand (as of Q2 2020)
5references:
6 - "https://www.pcmag.com/news/google-and-amazon-are-impersonated-the-most-in-phishing-scams"
7 - "https://sellercentral.amazon.com/gp/help/external/32261?language=en-US"
8type: "rule"
9severity: "low"
10source: |
11 type.inbound
12 and not any(headers.hops,
13 any(.fields,
14 .name == 'X-Amazon-Mail-Relay-Type' and .value == "notification"
15 )
16 )
17 and (
18 regex.icontains(sender.display_name,
19 '\b[aaa๐ฐa๏ฝ๐๐ฎ๐๐๐ช๐๐ชะฐษฮฑ๐๐๐ข๐โบ๐ถ๐๐ถ๐ผ๐๐บ]maz[o0]n\s?(pay|marketplace|\.com)|แตโคปแถป'
20 )
21 or strings.ilevenshtein(sender.display_name, 'amazon.com') <= 1
22 or strings.ilevenshtein(sender.display_name, 'amazon pay') <= 1
23 or strings.ilevenshtein(sender.display_name, 'amazon marketplace') <= 1
24 or strings.ilevenshtein(sender.display_name, 'amazon customer support') <= 1
25 or regex.icontains(sender.display_name,
26 "prime (?:subscription|notification|support)",
27 '^primevideo'
28 )
29 or regex.imatch(sender.display_name,
30 '^(?:amazon\s)?prime (?:deals?|store)$',
31 'amazon'
32 )
33 or strings.ilike(subject.subject, "*prime membership*")
34 // prime subscription id ##
35 or (
36 strings.icontains(subject.base, "prime")
37 and regex.icontains(body.current_thread.text, 'subscription\s+id\s?.\s\w+')
38 )
39 or (
40 strings.ilevenshtein(sender.display_name, 'amazon') <= 1
41 and sender.email.domain.root_domain in $free_email_providers
42 )
43 or (
44 any(ml.nlu_classifier(body.current_thread.text).intents,
45 .name == "cred_theft" and .confidence == "high"
46 )
47 and any(ml.nlu_classifier(body.current_thread.text).topics,
48 .name in (
49 "Security and Authentication",
50 "Secure Message",
51 "Reminders and Notifications",
52 "Order Confirmations",
53 "Customer Service and Support"
54 )
55 )
56 and strings.icontains(body.current_thread.text, "amazon")
57 )
58 or (
59 (
60 any([body.current_thread.text, body.html.inner_text],
61 strings.istarts_with(., 'amazon')
62 )
63 or any(ml.logo_detect(file.message_screenshot()).brands,
64 .name == "Amazon" and .confidence == "high"
65 )
66 )
67 and length(body.current_thread.links) < 10
68 and any(body.current_thread.links,
69 strings.istarts_with(.display_text, 'amazon')
70 and .href_url.domain.sld != "amazon"
71 )
72 )
73 or (
74 //
75 // This rule makes use of a beta feature and is subject to change without notice
76 // using the beta feature in custom rules is not suggested until it has been formally released
77 //
78 any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
79 .name == "callback_scam" and .confidence != "low"
80 )
81 and (
82 (
83 length(body.current_thread.text) == 0
84 and length(filter(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text
85 ).entities,
86 .name == "org" and strings.icontains(.text, 'amazon')
87 )
88 ) > 3
89 )
90 or regex.imatch(body.current_thread.text,
91 'amazon(?:\s+\w+)?\s+invoice.*',
92 'order confirmation from amazon.*'
93 )
94 or (
95 length(body.current_thread.links) <= 1
96 and length(filter(ml.nlu_classifier(body.current_thread.text).entities,
97 .name == "org" and strings.icontains(.text, 'amazon')
98 )
99 ) > 3
100 )
101 )
102 )
103 )
104 // negate listservs
105 and not (
106 any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
107 and strings.contains(sender.display_name, "via")
108 )
109 and sender.email.domain.root_domain not in~ (
110 'amazon.com',
111 'amazon.com.au',
112 'amazon.de',
113 'amazon.es',
114 'amazon.fr',
115 'amazon.it',
116 'amazon.in',
117 'amazon.lu',
118 'amazon.nl',
119 'amazonsellerservices.com',
120 'amazon.ae',
121 'amazon.sa',
122 'amazon.com.sg',
123 'amazon.co.uk',
124 'amazon.co.jp',
125 'amazon.com.mx',
126 'amazon.com.br',
127 'amazon.com.tr',
128 'amazon.cn',
129 'amazon.ca',
130 'amazon.sg',
131 'amazonaws.cn',
132 'amazonpay.in',
133 'amazonpay.com',
134 'q4inc.com',
135 'synchronybank.com',
136 'opodo.com',
137 'flynas.com',
138 'amazonmusic.com',
139 'blink.com',
140 'affirm.com',
141 'amazon.work',
142 'amazon.jobs',
143 'rocketmoney.com',
144 'registrar.amazon',
145 'amazonworkspaces.com',
146 'awsapps.com',
147 'aws.com',
148 'awsevents.com',
149 'amazon.se',
150 'amazon.ie',
151 'amazonconnect.com',
152 'aws-experience.com',
153 'proofpointessentials.com',
154 'area1security.com',
155 'marketplace.aws',
156 'quicksight.aws',
157 'amazonpreview.com'
158 )
159
160 // negate amazon.com.be explicitly, this cannot be part of the root_domain set above as it uses the PSL (Public suffix list) for parsing and com.be is owned by amazon directly.
161 and sender.email.domain.domain not in~ ('amazon.com.be')
162 and sender.email.email not in $recipient_emails
163 and sender.email.domain.domain not in $org_domains
164
165 // negate highly trusted sender domains unless they fail DMARC authentication
166 and not (
167 sender.email.domain.root_domain in $high_trust_sender_root_domains
168 and coalesce(headers.auth_summary.dmarc.pass, false)
169 )
170
171attack_types:
172 - "Credential Phishing"
173tactics_and_techniques:
174 - "Impersonation: Brand"
175 - "Social engineering"
176detection_methods:
177 - "Header analysis"
178 - "Sender analysis"
179id: "13fc967d-4cc6-501d-9637-8c0761a1a354"