Brand impersonation: Barracuda Networks

 1name: "Brand impersonation: Barracuda Networks"
 2description: |
 3    Impersonation of Barracuda Networks, an IT security company.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  and (
 9    strings.ilike(sender.display_name, '*barracuda*')
10    or strings.ilevenshtein(sender.display_name, 'barracuda') <= 1
11    or strings.ilike(sender.email.domain.domain, '*barracuda*')
12  )
13  and not (
14    sender.email.domain.root_domain in (
15      'barracuda.com',
16      'barracudamsp.com',
17      'barracudanetworks.com',
18      'netsuite.com',
19
20      // hockey team
21      'sharkssports.net',
22      'sjbarracuda.com',
23
24      // Barracuda Barcatering
25      'barracuda-barcatering.de',
26
27      // Barracuda Events Team
28      'worldspan.co.uk',
29
30      // Barracudas Day Camps
31      'barracudas.co.uk',
32
33      // BarracudaShoes
34      'barracudashoes.it'
35    )
36    and coalesce(headers.auth_summary.dmarc.pass, false)
37  )
38
39  // negate bouncebacks
40  and not any(ml.nlu_classifier(body.current_thread.text).topics,
41              .name == "Bounce Back and Delivery Failure Notifications"
42  )
43
44  // sender profiles
45  and (
46    profile.by_sender().prevalence in ("new", "outlier")
47    or (
48      profile.by_sender().any_messages_malicious_or_spam
49      and not profile.by_sender().any_messages_benign
50    )
51  )  
52
53attack_types:
54  - "Credential Phishing"
55tactics_and_techniques:
56  - "Impersonation: Brand"
57  - "Lookalike domain"
58  - "Social engineering"
59detection_methods:
60  - "Header analysis"
61  - "Sender analysis"
62id: "583fd5eb-ebd1-5753-944c-1d85f2a82348"