Brand impersonation: Wix

Detects messages impersonating Wix by using similar display names or domain names, while not originating from legitimate WIX domains or failing DMARC authentication from trusted senders.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Wix"
 2description: "Detects messages impersonating Wix by using similar display names or domain names, while not originating from legitimate WIX domains or failing DMARC authentication from trusted senders."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      regex.icontains(sender.display_name, '^WIX\b')
10      or strings.ilike(sender.email.domain.domain, 'WIX')
11    )
12    or (
13      strings.icontains(sender.display_name, 'wix')
14      and regex.icontains(body.current_thread.text,
15                          "Domain Expir(?:ation|y) Not(?:ice|ification)"
16      )
17      and strings.icontains(body.current_thread.text, "will be deactivated")
18    )
19    // Wix address from footer
20    or 2 of (
21      strings.icontains(body.current_thread.text, 'Wix.com'),
22      strings.icontains(body.current_thread.text, '100 Gansevoort St'),
23      strings.icontains(body.current_thread.text, 'New York, NY 10014')
24    )
25  )
26  and not (
27    (
28      sender.email.domain.root_domain in~ (
29        "wix.com",
30        "wixforms.com",
31        "wixemails.com",
32        "wixanswers.com",
33        "wix-groups.com",
34        "ascendbywix.com"
35      )
36      and headers.auth_summary.dmarc.pass
37    )
38  )
39  // negation for messages traversing wix.com 
40  and not (
41    any(headers.domains, .root_domain in ("wix.com", "ascendbywix.com"))
42    and headers.auth_summary.spf.pass
43    and headers.auth_summary.dmarc.pass
44  )
45  and not profile.by_sender().solicited
46  // negate highly trusted sender domains unless they fail DMARC authentication
47  and (
48    (
49      sender.email.domain.root_domain in $high_trust_sender_root_domains
50      and not headers.auth_summary.dmarc.pass
51    )
52    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
53  )  
54
55attack_types:
56  - "Credential Phishing"
57tactics_and_techniques:
58  - "Impersonation: Brand"
59  - "Lookalike domain"
60  - "Social engineering"
61detection_methods:
62  - "Header analysis"
63  - "Sender analysis"
64id: "45e7b99f-94fc-5ae4-b5c9-ebfb59b04fe9"
to-top