Brand impersonation: Amazon

  1name: "Brand impersonation: Amazon"
  2description: |
  3  Impersonation of Amazon. These are most commonly fake shipping notifications.
  4  Amazon is the #2 most-impersonated brand (as of Q2 2020)  
  5references:
  6  - "https://www.pcmag.com/news/google-and-amazon-are-impersonated-the-most-in-phishing-scams"
  7  - "https://sellercentral.amazon.com/gp/help/external/32261?language=en-US"
  8type: "rule"
  9severity: "low"
 10source: |
 11  type.inbound
 12  and not any(headers.hops,
 13              any(.fields,
 14                  .name == 'X-Amazon-Mail-Relay-Type' and .value == "notification"
 15              )
 16  )
 17  and (
 18    regex.icontains(sender.display_name,
 19                    '\b[aaa𝝰aａ𝑎𝗮𝕒𝖆𝓪𝚊𝞪аɑα𝔞𝒂𝘢𝛂⍺𝒶𝙖𝜶𝛼𝐚𝖺]maz[o0]n\s?(pay|marketplace|\.com)|ᵃ⤻ᶻ'
 20    )
 21    or strings.ilevenshtein(sender.display_name, 'amazon.com') <= 1
 22    or strings.ilevenshtein(sender.display_name, 'amazon pay') <= 1
 23    or strings.ilevenshtein(sender.display_name, 'amazon marketplace') <= 1
 24    or strings.ilevenshtein(sender.display_name, 'amazon customer support') <= 1
 25    or regex.icontains(sender.display_name,
 26                       "prime (?:subscription|notification|support)"
 27    )
 28    or regex.imatch(sender.display_name,
 29                    '^(?:amazon\s)?prime (?:deals?|store)$',
 30                    'amazon'
 31    )
 32    or strings.ilike(subject.subject, "*prime membership*")
 33    // prime subscription id ##
 34    or (
 35      strings.icontains(subject.base, "prime")
 36      and regex.icontains(body.current_thread.text, 'subscription\s+id\s?.\s\w+')
 37    )
 38    or (
 39      strings.ilevenshtein(sender.display_name, 'amazon') <= 1
 40      and sender.email.domain.root_domain in $free_email_providers
 41    )
 42    or (
 43      any(ml.nlu_classifier(body.current_thread.text).intents,
 44          .name == "cred_theft" and .confidence == "high"
 45      )
 46      and any(ml.nlu_classifier(body.current_thread.text).topics,
 47              .name in (
 48                "Security and Authentication",
 49                "Secure Message",
 50                "Reminders and Notifications",
 51                "Order Confirmations",
 52                "Customer Service and Support"
 53              )
 54      )
 55      and strings.icontains(body.current_thread.text, "amazon")
 56    )
 57    or (
 58      //
 59      // This rule makes use of a beta feature and is subject to change without notice
 60      // using the beta feature in custom rules is not suggested until it has been formally released
 61      //
 62      any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
 63          .name == "callback_scam" and .confidence != "low"
 64      )
 65      and regex.imatch(body.current_thread.text, 'amazon(?:\s+\w+)?\s+invoice.*')
 66    )
 67  )
 68  // negate listservs
 69  and not (
 70    any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
 71    and strings.contains(sender.display_name, "via")
 72  )
 73  and sender.email.domain.root_domain not in~ (
 74    'amazon.com',
 75    'amazon.com.au',
 76    'amazon.de',
 77    'amazon.es',
 78    'amazon.fr',
 79    'amazon.it',
 80    'amazon.in',
 81    'amazon.lu',
 82    'amazon.nl',
 83    'amazonsellerservices.com',
 84    'amazon.ae',
 85    'amazon.sa',
 86    'amazon.com.sg',
 87    'amazon.co.uk',
 88    'amazon.co.jp',
 89    'amazon.com.mx',
 90    'amazon.com.br',
 91    'amazon.com.tr',
 92    'amazon.cn',
 93    'amazon.ca',
 94    'amazon.sg',
 95    'amazonaws.cn',
 96    'amazonpay.in',
 97    'amazonpay.com',
 98    'q4inc.com',
 99    'synchronybank.com',
100    'opodo.com',
101    'flynas.com',
102    'amazonmusic.com',
103    'blink.com',
104    'affirm.com',
105    'amazon.work',
106    'amazon.jobs',
107    'rocketmoney.com',
108    'registrar.amazon',
109    'amazonworkspaces.com',
110    'awsapps.com',
111    'aws.com',
112    'awsevents.com',
113    'amazon.se',
114    'amazon.ie',
115    'amazonconnect.com',
116    'aws-experience.com',
117    'proofpointessentials.com',
118    'area1security.com',
119    'marketplace.aws',
120    'quicksight.aws'
121  )
122  
123  // negate amazon.com.be explicitly, this cannot be part of the root_domain set above as it uses the PSL (Public suffix list) for parsing and com.be is owned by amazon directly.
124  and sender.email.domain.domain not in~ ('amazon.com.be')
125  and sender.email.email not in $recipient_emails
126  and sender.email.domain.domain not in $org_domains
127  
128  // negate highly trusted sender domains unless they fail DMARC authentication
129  and not (
130    sender.email.domain.root_domain in $high_trust_sender_root_domains
131    and coalesce(headers.auth_summary.dmarc.pass, false)
132  )  
133
134attack_types:
135  - "Credential Phishing"
136tactics_and_techniques:
137  - "Impersonation: Brand"
138  - "Social engineering"
139detection_methods:
140  - "Header analysis"
141  - "Sender analysis"
142id: "13fc967d-4cc6-501d-9637-8c0761a1a354"