Brand impersonation: Kroger

 1name: "Brand impersonation: Kroger"
 2description: "Detects inbound messages that impersonate Kroger through a spoofed display name or local part while referencing loyalty program terms such as boost membership, renewal, verification, or points balance in the body or a rendered screenshot. Legitimate messages from verified Kroger domains or high trust senders that pass DMARC, as well as newsletters/digests, are excluded to reduce false positives."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    regex.icontains(sender.display_name, 'kroger\b')
 9    or strings.istarts_with(sender.email.local_part, 'kroger')
10  )
11  //
12  // This rule makes use of a beta feature and is subject to change without notice
13  // using the beta feature in custom rules is not suggested until it has been formally released
14  //
15  and any([body.current_thread.text, beta.ocr(file.message_screenshot()).text],
16          strings.icontains(., 'kroger')
17          and (
18            strings.icontains(.,
19                              'boost membership',
20                              'customer number',
21                              'brief online survey',
22                              'points balance',
23                              'fuel savings',
24                              'loyalty member',
25                              'start survey',
26                              'special member offer',
27                              'loyalty program'
28            )
29            or regex.icontains(., 'shopping\s?cart reward')
30          )
31  )
32  and not any(ml.nlu_classifier(body.current_thread.text).topics,
33              .name in ("Newsletters and Digests", "Legal and Compliance")
34  )
35  and not (
36    sender.email.domain.root_domain in (
37      "kroger.com",
38      "krogermail.com",
39      "thekrogerco.com",
40      "perkspot.com"
41    )
42    and coalesce(headers.auth_summary.dmarc.pass, false)
43  )
44  and not (
45    sender.email.domain.root_domain in $high_trust_sender_root_domains
46    and coalesce(headers.auth_summary.dmarc.pass, false)
47  )  
48attack_types:
49  - "Credential Phishing"
50  - "BEC/Fraud"
51tactics_and_techniques:
52  - "Impersonation: Brand"
53  - "Social engineering"
54  - "Image as content"
55detection_methods:
56  - "Sender analysis"
57  - "Content analysis"
58  - "Optical Character Recognition"
59  - "Natural Language Understanding"
60  - "Header analysis"
61id: "23c90d6e-11bf-51a6-b34d-6de360f6f294"