Brand Impersonation: Chase bank with credential phishing indicators
This rule checks for messages with or without attachments leveraging the Chase logo, and LinkAnalysis or Natural Language Understanding(NLU) has flagged credential phishing with medium to high confidence. The rule also excludes messages where all links are Chase affiliates, in addition to negating high trust sender root domains.
Sublime rule (View on GitHub)
1name: "Brand Impersonation: Chase bank with credential phishing indicators"
2description: "This rule checks for messages with or without attachments leveraging the Chase logo, and LinkAnalysis or Natural Language Understanding(NLU) has flagged credential phishing with medium to high confidence. The rule also excludes messages where all links are Chase affiliates, in addition to negating high trust sender root domains."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and (
8 (
9 length(attachments) <= 3
10 and any(attachments,
11 .file_type in $file_types_images
12 and any(ml.logo_detect(.).brands, .name == "Chase")
13 )
14 )
15 or (
16 length(attachments) == 0
17 and any(ml.logo_detect(beta.message_screenshot()).brands, .name == "Chase")
18 )
19 )
20 and 0 < length(body.links) < 10
21 and (
22 any(body.links,
23 any([beta.linkanalysis(.)],
24 .credphish.disposition == "phishing"
25 and .credphish.brand.confidence in ("medium", "high")
26 )
27 )
28 or any(ml.nlu_classifier(body.current_thread.text).intents,
29 .name in ("cred_theft") and .confidence in ("medium", "high")
30 )
31 )
32 and not all(body.links,
33 .href_url.domain.root_domain in (
34 "chasecdn.com",
35 "chase.com",
36 "chase.co.uk",
37 "gslbjpmchase.com",
38 "jpmorganchase.com",
39 "jpmorgan.com",
40 "jpmorganfunds.com",
41 "jpmprivatebank.com",
42 "paymentech.com"
43 )
44 )
45
46 // negate highly trusted sender domains unless they fail DMARC authentication
47 and (
48 (
49 sender.email.domain.root_domain in $high_trust_sender_root_domains
50 and (
51 any(distinct(headers.hops, .authentication_results.dmarc is not null),
52 strings.ilike(.authentication_results.dmarc, "*fail")
53 )
54 )
55 )
56 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
57 )
58
59 and (
60 not profile.by_sender().solicited
61 or profile.by_sender().any_messages_malicious_or_spam
62 )
63attack_types:
64 - "Credential Phishing"
65tactics_and_techniques:
66 - "Impersonation: Brand"
67 - "Social engineering"
68detection_methods:
69 - "Computer Vision"
70 - "File analysis"
71 - "Natural Language Understanding"
72 - "Sender analysis"
73 - "URL analysis"
74id: "d9577856-0ea6-571b-a245-1dd367555e6a"