Brand impersonation: Github

 1name: "Brand impersonation: Github"
 2description: |
 3    Impersonation of Github.
 4references:
 5  - "https://github.blog/2020-04-14-sawfish-phishing-campaign-targets-github-users/"
 6type: "rule"
 7severity: "high"
 8source: |
 9  type.inbound
10  and not strings.ilike(sender.display_name,
11                        '*course*',
12                        '*bootcamp*',
13                        '*training*'
14  )
15  and (
16    strings.ilike(sender.display_name, '*github*')
17    or strings.ilike(sender.email.email, '*github*')
18    or strings.ilevenshtein(sender.email.domain.sld, 'github') <= 1
19  )
20  // negating listservs
21  and not (
22    any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
23    and (
24      strings.contains(sender.display_name, "via")
25      or strings.icontains(subject.subject, "monitor")
26    )
27  )
28  and not (
29    any(headers.hops, any(.fields, .name == "X-GitHub-Reason"))
30    and headers.auth_summary.dmarc.pass
31  )
32  and not (
33    sender.email.domain.root_domain in (
34      'github.com',
35      'thegithubshop.com',
36      'gitlab.com',
37      'itthub.net',
38      'githubsupport.com',
39      'gtmhub.com',
40      'githubstatus.com',
41      'githubnext.com',
42      'lithub.com',
43      'icims.com',
44      'bithub.email',
45      'goldcast.io',
46      'luma-mail.com', // GitHub's event invitation software
47      'github.events' // GitHub event newsletters
48    )
49    and coalesce(headers.auth_summary.dmarc.pass, false)
50  )
51  
52  // negate highly trusted sender domains unless they fail DMARC authentication
53  and not (
54    sender.email.domain.root_domain in $high_trust_sender_root_domains
55    and coalesce(headers.auth_summary.dmarc.pass, false)
56  )
57  and (
58    not profile.by_sender().solicited
59    or (
60      profile.by_sender().any_messages_malicious_or_spam
61      and not profile.by_sender().any_messages_benign
62    )
63  )
64  and not profile.by_sender().any_messages_benign  
65attack_types:
66  - "Credential Phishing"
67tactics_and_techniques:
68  - "Impersonation: Brand"
69  - "Lookalike domain"
70  - "Social engineering"
71detection_methods:
72  - "Header analysis"
73  - "Sender analysis"
74id: "9402f92b-f2b1-5452-8124-fdad4a88feb4"