Impersonation: Legal firm with copyright infringement notice

  1name: "Impersonation: Legal firm with copyright infringement notice"
  2description: "Detects messages impersonating legal firms or copyright enforcement entities with extensive legal terminology, threatening language, and urgent compliance demands."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  and length(body.previous_threads) == 0
  8  and length(body.current_thread.text) < 5000
  9  and (
 10    0 < length(body.links) < 10 or beta.scan_qr(file.message_screenshot()).found
 11  )
 12  and (
 13    2 of (
 14      strings.ilike(subject.base, '*Content*'),
 15      strings.ilike(subject.base, '*Compliance*'),
 16      strings.ilike(subject.base, '*Review*'),
 17      strings.ilike(subject.base, '*Legal*'),
 18      strings.ilike(subject.base, '*Formal*'),
 19      strings.ilike(subject.base, '*LLP*'),
 20      strings.ilike(subject.base, '*PLLC*'),
 21      strings.ilike(subject.base, '*Unauthorized*'),
 22      strings.ilike(subject.base, '*Trademark*'),
 23      strings.ilike(subject.base, '*Law*'),
 24      strings.ilike(subject.base, '*Enforcement*'),
 25      strings.ilike(subject.base, '*Copyright*'),
 26      strings.ilike(subject.base, '*Violat*'),
 27      strings.ilike(subject.base, '*Intellectual*'),
 28      strings.ilike(subject.base, '*Concerning*'),
 29      strings.ilike(subject.base, '*Notice*'),
 30      strings.ilike(subject.base, '*Licensing*'),
 31      strings.ilike(subject.base, '*Clarification*'),
 32      strings.ilike(subject.base, '*Matter*'),
 33      strings.ilike(subject.base, '*Conflict*'),
 34      strings.ilike(subject.base, '*Ownership*'),
 35      strings.ilike(sender.display_name, '*Content*'),
 36      strings.ilike(sender.display_name, '*Copyright*'),
 37      strings.ilike(sender.display_name, '*Review*'),
 38      strings.ilike(sender.display_name, '*Legal*'),
 39      strings.ilike(sender.display_name, '*Investigation*'),
 40      strings.ilike(sender.display_name, '*LLP*'),
 41      strings.ilike(sender.display_name, '*Law*'),
 42      strings.ilike(sender.display_name, '*Intellectual*'),
 43      strings.ilike(sender.display_name, '*Notice*'),
 44      strings.ilike(sender.display_name, '*Matter*'),
 45      strings.ilike(sender.display_name, '*Dispute*'),
 46      strings.ilike(sender.display_name, '*Resolution*'),
 47      strings.ilike(sender.display_name, '*Advisory*'),
 48      (
 49        sender.email.domain.root_domain in $free_email_providers
 50        and any(body.current_thread.links,
 51                .href_url.domain.root_domain in $url_shorteners
 52                or any(.href_url.query_params_decoded['domain'],
 53                       . in $url_shorteners
 54                )
 55        )
 56      ),
 57      any(body.links,
 58          regex.icontains(.display_text,
 59                          '(?:evidence|exhibits?|supporting document|documentazione)'
 60          )
 61      )
 62    )
 63  )
 64  
 65  // common strings in email current thread
 66  and 15 of (
 67    strings.ilike(body.current_thread.text, '*copyright*'),
 68    strings.ilike(body.current_thread.text, '*trademark*'),
 69    strings.ilike(body.current_thread.text, '*inquiry*'),
 70    strings.ilike(body.current_thread.text, '*online*'),
 71    strings.ilike(body.current_thread.text, '*authorized*'),
 72    strings.ilike(body.current_thread.text, '*legal*'),
 73    strings.ilike(body.current_thread.text, '*represent*'),
 74    strings.ilike(body.current_thread.text, '*lawful*'),
 75    strings.ilike(body.current_thread.text, '*owner*'),
 76    strings.ilike(body.current_thread.text, '*materials*'),
 77    strings.ilike(body.current_thread.text, '*protected*'),
 78    strings.ilike(body.current_thread.text, '*infring*'),
 79    strings.ilike(body.current_thread.text, '*immediate*'),
 80    strings.ilike(body.current_thread.text, '*cessation*'),
 81    strings.ilike(body.current_thread.text, '*content*'),
 82    strings.ilike(body.current_thread.text, '*referenced*'),
 83    strings.ilike(body.current_thread.text, '*17 U.S.C. §*'),
 84    strings.ilike(body.current_thread.text, '*constitutes*'),
 85    strings.ilike(body.current_thread.text, '*authorization*'),
 86    strings.ilike(body.current_thread.text, '*removal*'),
 87    strings.ilike(body.current_thread.text, '*comply*'),
 88    strings.ilike(body.current_thread.text, '*failure*'),
 89    strings.ilike(body.current_thread.text, '*law firm*'),
 90    strings.ilike(body.current_thread.text, '*LLP*'),
 91    strings.ilike(body.current_thread.text, '*compliance*'),
 92    strings.ilike(body.current_thread.text, '*cease*'),
 93    strings.ilike(body.current_thread.text, '*protect*'),
 94    strings.ilike(body.current_thread.text, '*rights*'),
 95    strings.ilike(body.current_thread.text, '*penalty*'),
 96    strings.ilike(body.current_thread.text, '*perjury*'),
 97    strings.ilike(body.current_thread.text, '*holder*'),
 98    strings.ilike(body.current_thread.text, '*declare*'),
 99    strings.ilike(body.current_thread.text, '*sworn*'),
100    strings.ilike(body.current_thread.text, '*affidavit*'),
101    strings.ilike(body.current_thread.text, '*investigation*'),
102    strings.ilike(body.current_thread.text, '*identified*'),
103    strings.ilike(body.current_thread.text, '*reproduction*'),
104    strings.ilike(body.current_thread.text, '*license*'),
105    strings.ilike(body.current_thread.text, '*granted*'),
106    strings.ilike(body.current_thread.text, '*permitting*'),
107    strings.ilike(body.current_thread.text, '*evidence*'),
108    strings.ilike(body.current_thread.text, '*proceedings*'),
109    strings.ilike(body.current_thread.text, '*evidentiary*'),
110    strings.ilike(body.current_thread.text, '*remove*'),
111    strings.ilike(body.current_thread.text, '*suspend*'),
112    strings.ilike(body.current_thread.text, '*discontinue*'),
113    strings.ilike(body.current_thread.text, '*72 hours*'),
114    strings.ilike(body.current_thread.text, '*48 hours*'),
115    strings.ilike(body.current_thread.text, '*24 hours*'),
116    strings.ilike(body.current_thread.text, '*proof*'),
117    strings.ilike(body.current_thread.text, '*unresolved*'),
118    strings.ilike(body.current_thread.text, '*accordance*'),
119    strings.ilike(body.current_thread.text, '*procedures*'),
120    strings.ilike(body.current_thread.text, '*interests*'),
121    strings.ilike(body.current_thread.text, '*appeal*'),
122    strings.ilike(body.current_thread.text, '*clarification*'),
123    strings.ilike(body.current_thread.text, '*notice*'),
124    strings.ilike(body.current_thread.text, '*dissemination*'),
125    strings.ilike(body.current_thread.text, '*counter-notice*'),
126    strings.ilike(body.current_thread.text, '*exploitation*'),
127    strings.ilike(body.current_thread.text, '*remedial*'),
128    strings.ilike(body.current_thread.text, '*particulars*'),
129    strings.ilike(body.current_thread.text, '*fingerprint*'),
130    strings.ilike(body.current_thread.text, '*confidentiality*'),
131    strings.ilike(body.current_thread.text, '*assertion*'),
132    strings.ilike(body.current_thread.text, '*counsel*'),
133    strings.ilike(body.current_thread.text, '*privileged*'),
134    strings.ilike(body.current_thread.text, '*directive*'),
135  )
136  
137  // remove phrase from legitimate complaint
138  and not regex.icontains(body.current_thread.text,
139                          '(?:we are passing the notice below|content has been removed|removed from our website|notice of intended action|I have not granted|I am the original creator|content you reported has been removed|complaint will be carefully reviewed|provide a list of violations|document confirming your right to act)'
140  )
141  
142  // not copyright reports
143  and not regex.icontains(body.current_thread.text,
144                          '(?:confirmation|received).{0,100}copyright report'
145  )
146  
147  // verified dmca receiving/sending address
148  and not any([recipients.cc, recipients.to, recipients.bcc],
149              any(.,
150                  .email.email in (
151                    'dmca@vimeo.com',
152                    'dmca@support.epicgames.com',
153                    'takedowns@doppel.com',
154                    'ipenforcement@epicgames.com'
155                  )
156              )
157  )
158  and not strings.icontains(sender.email.domain.root_domain, 'edwinjamesip.com')  
159attack_types:
160  - "BEC/Fraud"
161  - "Extortion"
162tactics_and_techniques:
163  - "Impersonation: Brand"
164  - "Social engineering"
165detection_methods:
166  - "Content analysis"
167  - "Header analysis"
168  - "Sender analysis"
169id: "85bf58f6-3891-56ea-ae0a-d88073ade20f"