Brand impersonation: LinkedIn

 1name: "Brand impersonation: LinkedIn"
 2description: |
 3    Impersonation of LinkedIn.
 4references:
 5  - "https://www.arcyber.army.mil/Info/Fact-Sheets/Fact-Sheet-View-Page/Article/1972156/army-cyber-fact-sheet-linkedin-scams/"
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and (
11    sender.display_name =~ 'linkedin'
12    or strings.ilevenshtein(sender.display_name, 'linkedin') <= 2
13    or strings.ilevenshtein(sender.email.domain.root_domain, 'linkedin.com') <= 2
14    or strings.ilike(sender.email.domain.root_domain, "*linkedin.com")
15    or regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*linkedin')
16    or (
17      strings.icontains(body.current_thread.text, "linkedin")
18      and regex.icontains(body.current_thread.text, 'due\s+invoice\(s\)\s+\d+')
19    )
20    or strings.icontains(body.current_thread.text, 'linkedin subscription order')
21    or (
22      strings.ilike(sender.display_name, "*linkedin*")
23      and 1 of (
24        any(ml.nlu_classifier(body.current_thread.text).intents,
25            .name in ("cred_theft", "steal_pii") and .confidence == "high"
26        ),
27        network.whois(sender.email.domain).days_old <= 30
28        and strings.ilike(sender.email.email, "*linkedin*"),
29        (
30          length(headers.reply_to) > 0
31          and all(headers.reply_to,
32                  .email.domain.root_domain != sender.email.domain.root_domain
33          )
34          and all(headers.reply_to,
35                  .email.domain.root_domain != headers.return_path.domain.root_domain
36          )
37          and sender.email.domain.root_domain != headers.return_path.domain.root_domain
38        )
39      )
40    )
41  )
42  and sender.email.domain.root_domain not in (
43    'linkedin.com',
44    'smartrecruiters.com',
45    'teams-events.com',
46    'linkeen.com'
47  )
48  and sender.email.domain.domain not in ('linkedin.coupahost.com')
49  and sender.email.email not in $recipient_emails
50  and not regex.icontains(headers.message_id, '[^-]linkedin.com>$')
51  
52  // LinkedIn corporate uses DocuSign
53  and not (
54    sender.email.domain.root_domain in~ ('docusign.net', 'docusign.com')
55    and all(headers.reply_to, .email.domain.root_domain == 'linkedin.com')
56  )  
57attack_types:
58  - "Credential Phishing"
59tactics_and_techniques:
60  - "Impersonation: Brand"
61  - "Lookalike domain"
62  - "Social engineering"
63detection_methods:
64  - "Header analysis"
65  - "Sender analysis"
66id: "1a0cde6d-ce91-575f-a6a4-7a88b12f2ca4"