Brand impersonation: Wix
Detects messages impersonating Wix by using similar display names or domain names, while not originating from legitimate WIX domains or failing DMARC authentication from trusted senders.
Sublime rule (View on GitHub)
1name: "Brand impersonation: Wix"
2description: "Detects messages impersonating Wix by using similar display names or domain names, while not originating from legitimate WIX domains or failing DMARC authentication from trusted senders."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and (
8 (
9 regex.icontains(sender.display_name, '^WIX\b')
10 or strings.ilike(sender.email.domain.domain, 'WIX')
11 )
12 or (
13 strings.icontains(sender.display_name, 'wix')
14 and regex.icontains(body.current_thread.text,
15 "Domain Expir(?:ation|y) Not(?:ice|ification)"
16 )
17 and strings.icontains(body.current_thread.text, "will be deactivated")
18 )
19 // Wix address from footer
20 or 2 of (
21 strings.icontains(body.current_thread.text, 'Wix.com'),
22 strings.icontains(body.current_thread.text, '100 Gansevoort St'),
23 strings.icontains(body.current_thread.text, 'New York, NY 10014')
24 )
25 )
26 and not (
27 (
28 sender.email.domain.root_domain in~ (
29 "wix.com",
30 "wixforms.com",
31 "wixemails.com",
32 "wixanswers.com",
33 "wix-groups.com",
34 "ascendbywix.com"
35 )
36 and headers.auth_summary.dmarc.pass
37 )
38 )
39 // negation for messages traversing wix.com
40 and not (
41 any(headers.domains, .root_domain in ("wix.com", "ascendbywix.com"))
42 and headers.auth_summary.spf.pass
43 and headers.auth_summary.dmarc.pass
44 )
45 and not profile.by_sender().solicited
46 // negate highly trusted sender domains unless they fail DMARC authentication
47 and (
48 (
49 sender.email.domain.root_domain in $high_trust_sender_root_domains
50 and not headers.auth_summary.dmarc.pass
51 )
52 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
53 )
54
55attack_types:
56 - "Credential Phishing"
57tactics_and_techniques:
58 - "Impersonation: Brand"
59 - "Lookalike domain"
60 - "Social engineering"
61detection_methods:
62 - "Header analysis"
63 - "Sender analysis"
64id: "45e7b99f-94fc-5ae4-b5c9-ebfb59b04fe9"