Brand impersonation: Google Workspace alert notification

  1name: "Brand impersonation: Google Workspace alert notification"
  2description: "Detects messages impersonating Google Workspace alert notifications that use Google branding elements, workspace-specific terminology, and admin console references, but originate from non-Google domains and contain suspicious links."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  
  8  // Sender impersonates Google Workspace alerts but not from Google
  9  and (
 10    regex.icontains(sender.display_name,
 11                    '(?:workspace|google\s*workspace).*(?:alert|notification|center)',
 12                    '(?:alert|notification).*(?:workspace|google\s*workspace)',
 13                    'workspace\s+g[o0]{2}[gl]{2}e'
 14    )
 15    or regex.icontains(sender.email.local_part,
 16                       'workspace.*(?:alert|notification)',
 17                       'google.*workspace'
 18    )
 19    or any(ml.nlu_classifier(body.current_thread.text).entities,
 20           .name == "sender" and regex.imatch(.text, 'google workspace.*')
 21    )
 22  )
 23  and not (
 24    sender.email.domain.root_domain in~ (
 25      'google.com',
 26      'google.co.uk',
 27      'google.ca',
 28      'withgoogle.com'
 29    )
 30    and headers.auth_summary.dmarc.pass
 31  )
 32  
 33  // Negate legitimate Atlassian/Jira notifications that may contain Google Workspace content
 34  and not (
 35    sender.email.domain.root_domain in~ ('atlassian.net', 'atlassian.com')
 36    and headers.auth_summary.dmarc.pass
 37  )
 38  
 39  // Negate legitimate Google alerts forwarded through mailing lists
 40  and not (
 41    any(headers.hops,
 42        any(.fields,
 43            .name in ('X-Original-Sender', 'X-Original-From')
 44            and strings.ends_with(.value, '@google.com')
 45        )
 46    )
 47  )
 48  
 49  // Exclude Google Voice/phone call notifications
 50  and not (
 51    regex.icontains(subject.subject,
 52                    '(?:phone\s*call|voice\s*mail|missed\s*call)'
 53    )
 54    or regex.icontains(body.current_thread.text, 'Google\s*Voice')
 55  )
 56  
 57  // Exclude forwarded messages
 58  and not subject.is_forward
 59  
 60  // Body contains Google Workspace impersonation patterns
 61  and (
 62    // Alert center call to action with various phishing subjects
 63    (
 64      regex.icontains(body.current_thread.text, 'alert\s*cent(?:er|re)')
 65      and regex.icontains(subject.subject,
 66                          'spike\s+in\s+(?:user[- ]?reported\s+)?spam',
 67                          '(?:security|admin|workspace)\s+alert',
 68                          'suspicious\s+(?:activity|login|access)'
 69      )
 70    )
 71    // Reply-to address spoofs Google Workspace alerts
 72    or any(headers.reply_to,
 73           .email.email == 'google-workspace-alerts-noreply@google.com'
 74    )
 75    // Google Workspace logo hotlinked from gstatic
 76    or strings.icontains(body.html.raw,
 77                         'gstatic.com/apps/signup/resources/google-workspace-lockup.png',
 78                         'gstatic.com/apps/signup/resources/google-workspace-lockup.svg',
 79                         'gstatic.com/apps/signup/resources/google-workspace-lockup.jpg'
 80    )
 81  
 82    // Google corporate address
 83    or (
 84      strings.icontains(body.current_thread.text, '1600 Amphitheatre Parkway')
 85      and strings.icontains(body.current_thread.text, 'Mountain View, CA')
 86    )
 87    // Admin recipient messaging patterns
 88    or regex.icontains(body.current_thread.text, 'designated\s+admin\s+recipient')
 89    or (
 90      regex.icontains(body.current_thread.text,
 91                      'Google\s+Workspace(?:\s*account)?'
 92      )
 93      and regex.icontains(body.current_thread.text,
 94                          '(?:admin|administrator)\s+(?:console|recipient|account)'
 95      )
 96    )
 97    // Alert details structure common in these phishing attempts
 98    or (
 99      regex.icontains(body.current_thread.text, 'alert\s+details\s+include')
100      and regex.icontains(body.current_thread.text,
101                          '(?:activity\s+date|total\s+(?:user\s+)?reports|severity)'
102      )
103    )
104  )
105  
106  // Contains links that are not to Google
107  and any(body.links,
108          not .href_url.domain.root_domain in~ (
109            'google.com',
110            'google.co.uk',
111            'google.ca',
112            'gstatic.com',
113            'googleusercontent.com',
114            'sendgrid.net'
115          )
116  )  
117
118attack_types:
119  - "Credential Phishing"
120tactics_and_techniques:
121  - "Impersonation: Brand"
122  - "Social engineering"
123  - "Lookalike domain"
124detection_methods:
125  - "Header analysis"
126  - "Content analysis"
127  - "Sender analysis"
128  - "URL analysis"
129id: "143ffbc4-15ba-535e-b9d6-ab2e2862abe9"