Brand impersonation: Coinbase

 1name: "Brand impersonation: Coinbase"
 2description: |
 3  Impersonation of the cryptocurrency exchange Coinbase to harvest Coinbase credentials 
 4  or related information.  
 5references:
 6  - "https://blog.coinbase.com/phishing-attacks-and-how-to-not-fall-victim-42b489d77199"
 7type: "rule"
 8severity: "high"
 9source: |
10  type.inbound
11  and (
12    strings.ilike(sender.display_name, '*coinbase*')
13    or strings.ilevenshtein(sender.display_name, 'coinbase') <= 1
14    or strings.ilike(sender.email.domain.domain, '*coinbase*')
15  )
16  and sender.email.domain.root_domain not in~ ('coinbase.com', 'q4inc.com')
17  and (
18    // if this comes from a free email provider,
19    // flag if org has never sent an email to sender's email before
20    (
21      sender.email.domain.root_domain in $free_email_providers
22      and sender.email.email not in $recipient_emails
23    )
24    // if this comes from a custom domain,
25    // flag if org has never sent an email to sender's domain before
26    or (
27      sender.email.domain.root_domain not in $free_email_providers
28      and sender.email.domain.domain not in $recipient_domains
29    )
30  )
31
32  // negate highly trusted sender domains unless they fail DMARC authentication
33  and (
34    (
35      sender.email.domain.root_domain in $high_trust_sender_root_domains
36      and not headers.auth_summary.dmarc.pass
37    )
38    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
39  )  
40tags:
41  - "Cryptocurrency"
42attack_types:
43  - "Credential Phishing"
44tactics_and_techniques:
45  - "Impersonation: Brand"
46  - "Lookalike domain"
47  - "Social engineering"
48detection_methods:
49  - "Header analysis"
50  - "Sender analysis"
51id: "3dca757a-fb21-53c0-ac17-b0f110e8db60"