Brand Impersonation: Chase bank with credential phishing indicators

 1name: "Brand Impersonation: Chase bank with credential phishing indicators"
 2description: "This rule checks for messages with or without attachments leveraging the Chase logo, and LinkAnalysis or Natural Language Understanding(NLU) has flagged credential phishing with medium to high confidence. The rule also excludes messages where all links are Chase affiliates, in addition to negating high trust sender root domains."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      length(attachments) <= 3
10      and any(attachments,
11              .file_type in $file_types_images
12              and any(ml.logo_detect(.).brands, .name == "Chase")
13      )
14    )
15    or (
16      length(attachments) == 0
17      and any(ml.logo_detect(beta.message_screenshot()).brands, .name == "Chase")
18    )
19  )
20  and 0 < length(body.links) < 10
21  and (
22    any(body.links,
23        any([beta.linkanalysis(.)],
24            .credphish.disposition == "phishing"
25            and .credphish.brand.confidence in ("medium", "high")
26        )
27    )
28    or any(ml.nlu_classifier(body.current_thread.text).intents,
29           .name in ("cred_theft") and .confidence in ("medium", "high")
30    )
31  )
32  and not all(body.links,
33              .href_url.domain.root_domain in (
34                "chasecdn.com",
35                "chase.com",
36                "chase.co.uk",
37                "gslbjpmchase.com",
38                "jpmorganchase.com",
39                "jpmorgan.com",
40                "jpmorganfunds.com",
41                "jpmprivatebank.com",
42                "paymentech.com"
43              )
44  )
45  
46  // negate highly trusted sender domains unless they fail DMARC authentication
47  and (
48    (
49      sender.email.domain.root_domain in $high_trust_sender_root_domains
50      and (
51        any(distinct(headers.hops, .authentication_results.dmarc is not null),
52            strings.ilike(.authentication_results.dmarc, "*fail")
53        )
54      )
55    )
56    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
57  )
58
59  and (
60    not profile.by_sender().solicited
61    or profile.by_sender().any_messages_malicious_or_spam
62  )  
63attack_types:
64  - "Credential Phishing"
65tactics_and_techniques:
66  - "Impersonation: Brand"
67  - "Social engineering"
68detection_methods:
69  - "Computer Vision"
70  - "File analysis"
71  - "Natural Language Understanding"
72  - "Sender analysis"
73  - "URL analysis"
74id: "d9577856-0ea6-571b-a245-1dd367555e6a"