Impersonation: Legal firm with copyright infringement notice

  1name: "Impersonation: Legal firm with copyright infringement notice"
  2description: "Detects messages impersonating legal firms or copyright enforcement entities with extensive legal terminology, threatening language, and urgent compliance demands."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  and length(body.previous_threads) == 0
  8  and length(body.current_thread.text) < 5000
  9  and 0 < length(body.links) < 10
 10  
 11  // common strings in subject or base
 12  and (
 13    2 of (
 14      strings.ilike(subject.base, '*Content*'),
 15      strings.ilike(subject.base, '*Compliance*'),
 16      strings.ilike(subject.base, '*Review*'),
 17      strings.ilike(subject.base, '*Legal*'),
 18      strings.ilike(subject.base, '*Formal*'),
 19      strings.ilike(subject.base, '*LLP*'),
 20      strings.ilike(subject.base, '*Unauthorized*'),
 21      strings.ilike(subject.base, '*Trademark*'),
 22      strings.ilike(subject.base, '*Law*'),
 23      strings.ilike(subject.base, '*Enforcement*'),
 24      strings.ilike(subject.base, '*Copyright*'),
 25      strings.ilike(subject.base, '*Violat*'),
 26      strings.ilike(subject.base, '*Intellectual*'),
 27      strings.ilike(subject.base, '*Concerning*'),
 28      strings.ilike(subject.base, '*Notice*'),
 29      strings.ilike(subject.base, '*Clarification*'),
 30      strings.ilike(subject.base, '*Matter*'),
 31      strings.ilike(sender.display_name, '*Content*'),
 32      strings.ilike(sender.display_name, '*Copyright*'),
 33      strings.ilike(sender.display_name, '*Review*'),
 34      strings.ilike(sender.display_name, '*Legal*'),
 35      strings.ilike(sender.display_name, '*Investigation*'),
 36      strings.ilike(sender.display_name, '*LLP*'),
 37      strings.ilike(sender.display_name, '*Law*'),
 38      strings.ilike(sender.display_name, '*Intellectual*'),
 39      strings.ilike(sender.display_name, '*Notice*'),
 40      strings.ilike(sender.display_name, '*Matter*')
 41    )
 42  )
 43  
 44  // common strings in email current thread
 45  and 15 of (
 46    strings.ilike(body.current_thread.text, '*copyright*'),
 47    strings.ilike(body.current_thread.text, '*trademark*'),
 48    strings.ilike(body.current_thread.text, '*inquiry*'),
 49    strings.ilike(body.current_thread.text, '*online*'),
 50    strings.ilike(body.current_thread.text, '*authorized*'),
 51    strings.ilike(body.current_thread.text, '*legal*'),
 52    strings.ilike(body.current_thread.text, '*represent*'),
 53    strings.ilike(body.current_thread.text, '*lawful*'),
 54    strings.ilike(body.current_thread.text, '*owner*'),
 55    strings.ilike(body.current_thread.text, '*materials*'),
 56    strings.ilike(body.current_thread.text, '*protected*'),
 57    strings.ilike(body.current_thread.text, '*infring*'),
 58    strings.ilike(body.current_thread.text, '*immediate*'),
 59    strings.ilike(body.current_thread.text, '*cessation*'),
 60    strings.ilike(body.current_thread.text, '*content*'),
 61    strings.ilike(body.current_thread.text, '*referenced*'),
 62    strings.ilike(body.current_thread.text, '*17 U.S.C. §*'),
 63    strings.ilike(body.current_thread.text, '*constitutes*'),
 64    strings.ilike(body.current_thread.text, '*authorization*'),
 65    strings.ilike(body.current_thread.text, '*removal*'),
 66    strings.ilike(body.current_thread.text, '*comply*'),
 67    strings.ilike(body.current_thread.text, '*failure*'),
 68    strings.ilike(body.current_thread.text, '*law firm*'),
 69    strings.ilike(body.current_thread.text, '*LLP*'),
 70    strings.ilike(body.current_thread.text, '*compliance*'),
 71    strings.ilike(body.current_thread.text, '*cease*'),
 72    strings.ilike(body.current_thread.text, '*protect*'),
 73    strings.ilike(body.current_thread.text, '*rights*'),
 74    strings.ilike(body.current_thread.text, '*penalty*'),
 75    strings.ilike(body.current_thread.text, '*perjury*'),
 76    strings.ilike(body.current_thread.text, '*holder*'),
 77    strings.ilike(body.current_thread.text, '*declare*'),
 78    strings.ilike(body.current_thread.text, '*sworn*'),
 79    strings.ilike(body.current_thread.text, '*affidavit*'),
 80    strings.ilike(body.current_thread.text, '*investigation*'),
 81    strings.ilike(body.current_thread.text, '*identified*'),
 82    strings.ilike(body.current_thread.text, '*reproduction*'),
 83    strings.ilike(body.current_thread.text, '*license*'),
 84    strings.ilike(body.current_thread.text, '*granted*'),
 85    strings.ilike(body.current_thread.text, '*permitting*'),
 86    strings.ilike(body.current_thread.text, '*evidence*'),
 87    strings.ilike(body.current_thread.text, '*proceedings*'),
 88    strings.ilike(body.current_thread.text, '*evidentiary*'),
 89    strings.ilike(body.current_thread.text, '*remove*'),
 90    strings.ilike(body.current_thread.text, '*suspend*'),
 91    strings.ilike(body.current_thread.text, '*discontinue*'),
 92    strings.ilike(body.current_thread.text, '*72 hours*'),
 93    strings.ilike(body.current_thread.text, '*48 hours*'),
 94    strings.ilike(body.current_thread.text, '*24 hours*'),
 95    strings.ilike(body.current_thread.text, '*proof*'),
 96    strings.ilike(body.current_thread.text, '*unresolved*'),
 97    strings.ilike(body.current_thread.text, '*accordance*'),
 98    strings.ilike(body.current_thread.text, '*procedures*'),
 99    strings.ilike(body.current_thread.text, '*interests*'),
100    strings.ilike(body.current_thread.text, '*appeal*'),
101    strings.ilike(body.current_thread.text, '*clarification*'),
102    strings.ilike(body.current_thread.text, '*notice*')
103  )
104  
105  // remove phrase from legitimate complaint
106  and not regex.icontains(body.current_thread.text,
107                          '(?:we are passing the notice below|content has been removed|removed from our website|notice of intended action|I have not granted|I am the original creator|content you reported has been removed|complaint will be carefully reviewed|provide a list of violations|document confirming your right to act)'
108  )
109  
110  // not copyright reports
111  and not regex.icontains(body.current_thread.text,
112                          '(?:confirmation|received).{0,100}copyright report'
113  )
114  
115  // verified dmca receiving/sending address
116  and not any([recipients.cc, recipients.to, recipients.bcc],
117              any(.,
118                  .email.email in (
119                    'dmca@vimeo.com',
120                    'dmca@support.epicgames.com',
121                    'takedowns@doppel.com',
122                    'ipenforcement@epicgames.com'
123                  )
124              )
125  )
126  and not strings.icontains(sender.email.domain.root_domain, 'edwinjamesip.com')  
127attack_types:
128  - "BEC/Fraud"
129  - "Extortion"
130tactics_and_techniques:
131  - "Impersonation: Brand"
132  - "Social engineering"
133detection_methods:
134  - "Content analysis"
135  - "Header analysis"
136  - "Sender analysis"
137id: "85bf58f6-3891-56ea-ae0a-d88073ade20f"