Brand impersonation: DHL

  1name: "Brand impersonation: DHL"
  2description: |
  3    Impersonation of the shipping provider DHL.
  4references:
  5  - "https://www.helpnetsecurity.com/2020/08/21/q2-2020-email-security-trends/"
  6  - "https://www.dhl.com/ca-en/home/footer/fraud-awareness.html"
  7type: "rule"
  8severity: "low"
  9source: |
 10  type.inbound
 11  and (
 12    regex.icontains(sender.display_name, '\bDHL\b')
 13    or (
 14      strings.ilike(sender.email.domain.domain, '*DHL*')
 15      and length(sender.email.domain.domain) < 15
 16    )
 17    or strings.ilike(subject.subject, '*DHL notification*')
 18    or regex.icontains(subject.subject, 'dhl? express')
 19    or regex.contains(subject.subject, '\bD.{0,2}H.{0,2}L.{0,2}\b')
 20    or (
 21      any(ml.nlu_classifier(body.current_thread.text).topics,
 22          .name == "Shipping and Package" and .confidence == "high"
 23      )
 24      and (
 25        strings.contains(body.current_thread.text, 'DHL ')
 26        //
 27        // This rule makes use of a beta feature and is subject to change without notice
 28        // using the beta feature in custom rules is not suggested until it has been formally released
 29        //
 30        or strings.istarts_with(beta.ocr(file.message_screenshot()).text, 'DHL')
 31      )
 32    )
 33  )
 34  and (
 35    any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency")
 36    or any(ml.nlu_classifier(body.current_thread.text).entities,
 37           .name == "org"
 38           and (
 39             .text =~ "DHL"
 40             or .text =~ "DHL Express"
 41             or strings.istarts_with(.text, "DHL International")
 42           )
 43    )
 44    or any(ml.logo_detect(file.message_screenshot()).brands,
 45           .name == "DHL" and .confidence in ("medium", "high")
 46    )
 47    or regex.icontains(body.current_thread.text, '\bDHL\b')
 48    // it contains a QR code
 49    or (
 50      //
 51      // This rule makes use of a beta feature and is subject to change without notice
 52      // using the beta feature in custom rules is not suggested until it has been formally released
 53      //
 54      beta.scan_qr(file.message_screenshot()).found
 55      and any(beta.scan_qr(file.message_screenshot()).items, .type == "url")
 56    )
 57    //
 58    // This rule makes use of a beta feature and is subject to change without notice
 59    // using the beta feature in custom rules is not suggested until it has been formally released
 60    //
 61    or strings.ilike(beta.ocr(file.message_screenshot()).text,
 62                     "*package*",
 63                     "*parcel*",
 64                     "*shipping*",
 65                     "*delivery*",
 66                     "*track*"
 67    )
 68    or strings.ilike(body.current_thread.text,
 69                     "*package*",
 70                     "*parcel*",
 71                     "*shipping*",
 72                     "*delivery*",
 73                     "*track*"
 74    )
 75  )
 76  and (
 77    (
 78      (length(headers.references) > 0 or headers.in_reply_to is null)
 79      and not (
 80        (
 81          strings.istarts_with(subject.subject, "RE:")
 82          or strings.istarts_with(subject.subject, "RES:")
 83          or strings.istarts_with(subject.subject, "R:")
 84          or strings.istarts_with(subject.subject, "ODG:")
 85          or strings.istarts_with(subject.subject, "答复:")
 86          or strings.istarts_with(subject.subject, "AW:")
 87          or strings.istarts_with(subject.subject, "TR:")
 88          or strings.istarts_with(subject.subject, "FWD:")
 89          or regex.imatch(subject.subject, '(\[[^\]]+\]\s?){0,3}(re|fwd?)\s?:')
 90        )
 91      )
 92    )
 93    or length(headers.references) == 0
 94  )
 95  and sender.email.domain.root_domain not in~ (
 96    'dhl.com',
 97    'dhl-news.com',
 98    'bdhllp.com',
 99    'dhlecommerce.co.uk',
100    'dhlparcel.co.uk',
101    'dhlecs.com',
102    'dhl.co.uk',
103    'dhl.co.tz',
104    'dpdhl.com',
105    'dhl.de',
106    'dhl.fr',
107    'dhl.pl',
108    'dhlexpress.fr', // legit dhl site
109    'dhlending.com',
110    'inmotion.dhl',
111    'dhlparcel.nl',
112    'dhltariff.co.uk',
113    'dhlindia-kyc.com',
114    'dpogroup.com',
115    '4flow-service.com', // shipping service
116    'leaders-in-logistics.com', // legit sight for leadership webinar events
117    'deutschepost.de', // German postal service
118    'dhlecommerce.nl',
119    'dhl.nl',
120    'adhlawfirm.com', // similar name but unrelated
121    'attendhlth.com', // dhl in domain but unrelated
122    'tdhlaw.com', // dhl in domain but unrelated
123    'hapibenefits.com', // DHL rewards program
124    'dhlgpi.com', // DHL Australia
125    'dhlfreight-news.com'
126  )
127  and not (
128    sender.email.domain.tld in ('dhl')
129    and coalesce(headers.auth_summary.dmarc.pass, false)
130  )
131  and (
132    profile.by_sender().prevalence in ("new", "outlier")
133    or (
134      profile.by_sender().any_messages_malicious_or_spam
135      and not profile.by_sender().any_messages_benign
136    )
137  )
138  
139  // negate highly trusted sender domains unless they fail DMARC authentication
140  and not (
141    sender.email.domain.root_domain in $high_trust_sender_root_domains
142    and coalesce(headers.auth_summary.dmarc.pass, false)
143  )  
144attack_types:
145  - "Credential Phishing"
146tactics_and_techniques:
147  - "Impersonation: Brand"
148  - "Lookalike domain"
149  - "Social engineering"
150detection_methods:
151  - "Header analysis"
152  - "Sender analysis"
153id: "be4b4ae0-d393-5f8b-b984-5cf4ad7cbeb5"