Employee impersonation: Payroll fraud

  1name: "Employee impersonation: Payroll fraud"
  2description: |
  3  This rule detects messages impersonating employees, from unsolicited senders attempting to reroute payroll
  4  or alter payment details.  
  5type: "rule"
  6severity: "high"
  7source: |
  8  type.inbound
  9  // ensure the display name contains a space to avoid single named process accounts eg. 'billing, payment'
 10  and strings.contains(sender.display_name, " ")
 11  and (
 12    sender.display_name in~ $org_display_names
 13    or subject.base in~ $org_display_names
 14  )
 15  and length(attachments) == 0
 16  and length(body.links) < 10
 17  and (
 18    length(body.current_thread.text) < 800
 19    or (
 20      any(map(filter(ml.nlu_classifier(body.current_thread.text).entities,
 21                     .name == "disclaimer"
 22              ),
 23              .text
 24          ),
 25          (length(body.current_thread.text) - length(.)) < 800
 26      )
 27    )
 28  )
 29  and (
 30    sender.email.domain.root_domain not in $org_domains
 31    or sender.email.domain.root_domain in $free_email_providers
 32  )
 33  and 1 of (
 34    regex.icontains(body.current_thread.text,
 35                    '(?:pay\s?(?:roll|check|date|day)|direct deposit|(?:acct|account) rephrase|paid.{0,50}problems|\bACH\b|\bdd\b|gehalt|salario|salary|employee self[-\s]?service|\bESS\b.{0,30}(?:portal|access|log[-\s]?in)|access.{0,30}(?:HR|employee).{0,30}portal)'
 36    ),
 37    regex.icontains(subject.subject,
 38                    '(?:pay\s?(?:roll|check|date|day)|direct deposit|(?:acct|account) rephrase|paid.{0,50}problems|\bACH\b|\bdd\b|gehalt|salario|salary|employee self[-\s]?service|\bESS\b.{0,15}portal)'
 39    )
 40  )
 41  
 42  // sender profile negations
 43  and (
 44    not profile.by_sender_email().solicited
 45    or profile.by_sender().any_messages_malicious_or_spam
 46  )
 47  and not profile.by_sender().any_messages_benign
 48  
 49  // negate highly trusted sender domains unless they fail DMARC authentication
 50  and not (
 51    sender.email.domain.root_domain in $high_trust_sender_root_domains
 52    and coalesce(headers.auth_summary.dmarc.pass, false)
 53  )
 54  
 55  // negate legitimate conversations
 56  and not (
 57    (
 58      length(headers.references) > 0
 59      or headers.in_reply_to is not null
 60      or (
 61        any(headers.hops,
 62            any(.fields,
 63                strings.ilike(.name, "x-autoreply")
 64                and strings.ilike(.value, "yes")
 65            )
 66        )
 67      )
 68    )
 69    // previous thread present
 70    and (
 71      (
 72        (subject.is_forward or subject.is_reply)
 73        and length(body.previous_threads) >= 1
 74      )
 75      // automatic reply structure
 76      or (
 77        strings.istarts_with(subject.base, "automatic reply")
 78        or strings.istarts_with(subject.base, "out of office")
 79      )
 80    )
 81  )
 82  
 83  // ignore personal <> work emails
 84  and not (
 85    length(recipients.to) == 1
 86    and sender.email.domain.valid
 87    and all(headers.reply_to, .email.email == sender.email.email)
 88    and sender.display_name == mailbox.display_name
 89  )
 90  
 91  // topic negations
 92  and not any(ml.nlu_classifier(body.current_thread.text).topics,
 93              .name == "Advertising and Promotions"
 94  )  
 95
 96attack_types:
 97  - "BEC/Fraud"
 98tactics_and_techniques:
 99  - "Impersonation: Employee"
100  - "Free email provider"
101  - "Social engineering"
102detection_methods:
103  - "Content analysis"
104  - "Sender analysis"
105id: "2beb7d85-dfe3-5ecc-9b2a-d7416a3ef992"