Benefits enrollment impersonation

  1name: "Benefits enrollment impersonation"
  2description: "Detects messages about benefit enrollment periods and healthcare selections from external senders that contain urgent language or requests for action. Excludes legitimate HR communications, marketing mailers, and trusted sender domains with valid authentication."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and sender.email.domain.domain not in $org_domains
  8  and (
  9    length(body.current_thread.text) < 5000 or body.current_thread.text is null
 10  )
 11  and (
 12    regex.icontains(subject.subject,
 13                    '(open|benefits?) enrol{1,2}ment', // catches both enrolment and enrollment
 14                    'benefit(s)?.{0,10}(?:plan|choice|selection|deadline|period|summary|wellness)',
 15                    'hr benefits',
 16                    'annual enrol{1,2}ment',
 17                    'healthcare (choice|selection|opt.?in)',
 18                    '(fsa|hsa|401k) (enrol{1,2}ment|selection)',
 19                    'dependent (coverage|verification)',
 20                    '(health|dental|vision|insurance|medical) enrol{1,2}ment'
 21    )
 22    or any(ml.nlu_classifier(subject.base).topics,
 23           (.name == "Benefit Enrollment" and .confidence == "high")
 24           and (.name == "Health and Wellness" and .confidence != "low")
 25    )
 26    or regex.icontains(body.current_thread.text,
 27                       'benefit(s)? (plan|choice|selection|deadline|period)',
 28                       'hr benefits',
 29                       'annual enrol{1,2}ment',
 30                       'healthcare (choice|selection|opt.?in)',
 31                       '(fsa|hsa|401k) (enrol{1,2}ment|selection)',
 32                       'dependent (coverage|verification)',
 33                       '(health|dental|vision|insurance|medical) enrol{1,2}ment',
 34                       '(urgent|immediate) action required.{0,20}(benefit|enrol{1,2}ment)',
 35                       'coverage.{0,20}(expire|terminate)',
 36                       'last (day|chance).{0,20}(enrol{1,2}|select)',
 37                       '(login|sign.?in).{0,20}(benefit portal|hr portal)',
 38                       '(verify|update|confirm).{0,20}(benefit.{0,20}selection)'
 39    )
 40    or any(attachments,
 41           regex.icontains(.file_name,
 42                           'fileDoc-Review',
 43                           '(open|benefits?) enrol{1,2}ment',
 44                           'annual enrol{1,2}ment',
 45                           '(fsa|hsa|401k) (enrol{1,2}ment|selection)',
 46                           '(urgent|immediate) action required.{0,20}(benefit|enrol{1,2}ment)',
 47           )
 48    )
 49  )
 50  and 2 of (
 51    any(ml.nlu_classifier(body.current_thread.text).entities,
 52        .name in ("urgency", "request")
 53    ),
 54    any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign"),
 55    (
 56      (length(body.current_thread.text) < 250 and length(attachments) == 1)
 57      or (body.current_thread.text is null and length(attachments) == 1)
 58    ),
 59    // lure in attachment
 60    (
 61      any(attachments,
 62          (
 63            .file_type in $file_types_images
 64            or .file_type in ("pdf", "docx", "doc")
 65            or .file_extension in $file_extensions_macros
 66          )
 67          and any(filter(file.explode(.), .scan.ocr.raw is not null),
 68                  (
 69                    any(ml.nlu_classifier(.scan.ocr.raw).intents,
 70                        .name != "benign"
 71                    )
 72                    and any(ml.nlu_classifier(.scan.ocr.raw).entities,
 73                            .name in ("urgency", "request")
 74                    )
 75                  )
 76          )
 77      )
 78    )
 79  )
 80  // negate replies
 81  and (length(headers.references) == 0 or headers.in_reply_to is null)
 82  
 83  // Negate common marketing mailers
 84  and not regex.icontains(sender.display_name,
 85                          'HR (?:Events|Expert|Support Center|Studies|Knowledge Cloud|News Library|Crowd|Solutions|Interests)|HR and People Operations'
 86  )
 87  and not (
 88    // Constant Contact
 89    any(headers.hops,
 90        strings.icontains(.authentication_results.spf_details.designator,
 91                          "constantcontact.com"
 92        )
 93    )
 94    or any(headers.hops,
 95           strings.icontains(.received_spf.designator, "constantcontact.com")
 96    )
 97    or (
 98      (
 99        any(headers.hops,
100            .index == 0
101            and any(.authentication_results.dkim_details,
102                    .domain == "auth.ccsend.com"
103            )
104        )
105      )
106      and headers.auth_summary.dmarc.pass
107    )
108    or any(headers.references, strings.iends_with(., "ccsend.com"))
109    // Hubspot
110    or any(headers.hops,
111           strings.icontains(.authentication_results.spf_details.designator,
112                             "hubspotemail.net"
113           )
114    )
115  )
116  and sender.email.domain.root_domain not in~ (
117    'medicare.gov',
118    'farmers.com',
119    'uhc.com',
120    'blueshieldca.com',
121    'corestream.com'
122  )
123  and (
124    profile.by_sender().prevalence in ("new", "outlier")
125    or (
126      profile.by_sender().any_messages_malicious_or_spam
127      and not profile.by_sender().any_messages_benign
128    )
129  )
130  // negate highly trusted sender domains unless they fail DMARC authentication
131  and not (
132    sender.email.domain.root_domain in $high_trust_sender_root_domains
133    and coalesce(headers.auth_summary.dmarc.pass, false)
134  )  
135attack_types:
136  - "Credential Phishing"
137tactics_and_techniques:
138  - "Evasion"
139  - "Impersonation: Employee"
140  - "Out of band pivot"
141  - "Social engineering"
142detection_methods:
143  - "Content analysis"
144  - "Header analysis"
145  - "Sender analysis"
146id: "5a6eb5a8-2d91-5ed8-a0d2-fb3cc2fef40b"