Brand impersonation: Coinbase

 1name: "Brand impersonation: Coinbase"
 2description: |
 3  Impersonation of the cryptocurrency exchange Coinbase to harvest Coinbase credentials 
 4  or related information.  
 5references:
 6  - "https://blog.coinbase.com/phishing-attacks-and-how-to-not-fall-victim-42b489d77199"
 7type: "rule"
 8severity: "high"
 9source: |
10  type.inbound
11  and (
12    strings.ilike(strings.replace_confusables(sender.display_name), '*coinbase*')
13    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
14                            'coinbase'
15    ) <= 1
16    or strings.ilike(sender.email.domain.domain, '*coinbase*')
17  )
18  and not (
19    sender.email.domain.root_domain in (
20      'coinbase.com',
21      'q4inc.com',
22      'sendsafely.com' // used by Coinbase for verification codes
23    )
24    and headers.auth_summary.dmarc.pass
25  )
26  and (
27    // if this comes from a free email provider,
28    // flag if org has never sent an email to sender's email before
29    (
30      sender.email.domain.root_domain in $free_email_providers
31      and sender.email.email not in $recipient_emails
32    )
33    // if this comes from a custom domain,
34    // flag if org has never sent an email to sender's domain before
35    or (
36      sender.email.domain.root_domain not in $free_email_providers
37      and sender.email.domain.domain not in $recipient_domains
38    )
39  )
40  
41  // negate highly trusted sender domains unless they fail DMARC authentication
42  and not (
43    sender.email.domain.root_domain in $high_trust_sender_root_domains
44    and coalesce(headers.auth_summary.dmarc.pass, false)
45  )  
46tags:
47  - "Cryptocurrency"
48attack_types:
49  - "Credential Phishing"
50tactics_and_techniques:
51  - "Impersonation: Brand"
52  - "Lookalike domain"
53  - "Social engineering"
54detection_methods:
55  - "Header analysis"
56  - "Sender analysis"
57id: "3dca757a-fb21-53c0-ac17-b0f110e8db60"