Brand impersonation: Coinbase

 1name: "Brand impersonation: Coinbase"
 2description: |
 3  Impersonation of the cryptocurrency exchange Coinbase to harvest Coinbase credentials 
 4  or related information.  
 5references:
 6  - "https://blog.coinbase.com/phishing-attacks-and-how-to-not-fall-victim-42b489d77199"
 7type: "rule"
 8severity: "high"
 9source: |
10  type.inbound
11  and (
12    strings.ilike(sender.display_name, '*coinbase*')
13    or strings.ilevenshtein(sender.display_name, 'coinbase') <= 1
14    or strings.ilike(sender.email.domain.domain, '*coinbase*')
15  )
16  and sender.email.domain.root_domain not in~ ('coinbase.com', 'q4inc.com')
17  and (
18    // if this comes from a free email provider,
19    // flag if org has never sent an email to sender's email before
20    (
21      sender.email.domain.root_domain in $free_email_providers
22      and sender.email.email not in $recipient_emails
23    )
24    // if this comes from a custom domain,
25    // flag if org has never sent an email to sender's domain before
26    or (
27      sender.email.domain.root_domain not in $free_email_providers
28      and sender.email.domain.domain not in $recipient_domains
29    )
30  )
31
32  // negate highly trusted sender domains unless they fail DMARC authentication
33  and
34  (
35    (
36      sender.email.domain.root_domain in $high_trust_sender_root_domains
37      and (
38        any(distinct(headers.hops, .authentication_results.dmarc is not null),
39            strings.ilike(.authentication_results.dmarc, "*fail")
40        )
41      )
42    )
43    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
44  )  
45tags:
46  - "Cryptocurrency"
47attack_types:
48  - "Credential Phishing"
49tactics_and_techniques:
50  - "Impersonation: Brand"
51  - "Lookalike domain"
52  - "Social engineering"
53detection_methods:
54  - "Header analysis"
55  - "Sender analysis"
56id: "3dca757a-fb21-53c0-ac17-b0f110e8db60"