Brand impersonation: Chase Bank

 1name: "Brand impersonation: Chase Bank"
 2description: |
 3  Impersonation of Chase Bank and related services to harvest credentials or related information 
 4  such as dates of birth, phone numbers, social security numbers, ATM pin numbers, drivers license 
 5  numbers, selfies, and ID card photos.  
 6references:
 7  - "https://cyware.com/news/new-phishing-scam-impersonating-chase-bank-asks-for-sensitive-data-including-selfies-53065228"
 8type: "rule"
 9severity: "high"
10source: |
11  type.inbound
12  and (
13    strings.ilike(sender.display_name,
14                  '*chase sapphire*',
15                  '*chase card services*',
16                  '*united mileageplus*',
17                  "echase*"
18    )
19    or strings.ilevenshtein(sender.display_name, 'chase sapphire') <= 2
20    or strings.ilevenshtein(sender.display_name, 'chase card services') <= 2
21    or strings.ilevenshtein(sender.display_name, 'united mileageplus') <= 2
22    or (
23      strings.ilevenshtein(sender.display_name, 'echase') <= 1
24      // Negate Chase sender display name if cred theft, callback phishing, and a Chase logo isn't detected
25      and not (
26        strings.icontains(sender.display_name, 'chase')
27        and not (
28          any(ml.nlu_classifier(body.current_thread.text).intents,
29              .name == "cred_theft" and .confidence in ("medium", "high")
30          )
31          or any(ml.nlu_classifier(body.current_thread.text).intents,
32                 .name == "callback_scam" and .confidence in ("medium", "high")
33          )
34          or any(ml.logo_detect(beta.message_screenshot()).brands,
35                 strings.starts_with(.name, "Chase")
36          )
37        )
38      )
39    )
40    or strings.icontains(body.current_thread.text, 'Chase Privacy Operations')
41  )
42  and not (
43    sender.display_name is not null and sender.display_name in~ ("chaser", "case")
44  )
45  and sender.email.domain.root_domain not in~ ('chase.com', 'united.com', 'transunion.com', 'shopping-chase.com', 'chasetravel.com')
46  and (
47    profile.by_sender().prevalence in ("new", "outlier")
48    or (
49      profile.by_sender().any_messages_malicious_or_spam
50      and not profile.by_sender().any_false_positives
51    )
52  )
53
54  // negate highly trusted sender domains unless they fail DMARC authentication
55  and (
56    (
57      sender.email.domain.root_domain in $high_trust_sender_root_domains
58      and not headers.auth_summary.dmarc.pass
59    )
60    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
61  )
62  // and not solicited
63  and not profile.by_sender().solicited  
64attack_types:
65  - "Credential Phishing"
66tactics_and_techniques:
67  - "Impersonation: Brand"
68  - "Lookalike domain"
69  - "Social engineering"
70detection_methods:
71  - "Header analysis"
72  - "Sender analysis"
73id: "c680f1e7-01b9-5b95-897b-65957f4a57aa"