Brand impersonation: Meta and subsidiaries

Impersonation of Meta or Meta's subsidiaries Facebook and Instagram.

Sublime rule (View on GitHub)

  1name: "Brand impersonation: Meta and subsidiaries"
  2description: |
  3    Impersonation of Meta or Meta's subsidiaries Facebook and Instagram.
  4references:
  5  - "https://www.techrepublic.com/article/google-and-amazon-most-impersonated-brands-in-phishing-attacks/"
  6type: "rule"
  7severity: "medium"
  8source: |
  9  type.inbound
 10  and (
 11    // sender display name is a strong enough indicator
 12    // that it can be used without any other impersonation logic
 13    (
 14      regex.icontains(sender.display_name,
 15  
 16                      // this regex looks for a commonly abused phrase starting with 'meta', potentially containing a version of the word 'verified', followed by phrases that have been observed in campaigns.
 17                      '\bm.?e.?t.?a\b.*(?:verif(?:y|i(?:cado|ed)))?.*\b(?:recruiting|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|account|help|support|service|business|policy|Vérifié|certify|inc|help[ -]?desk)\b',
 18  
 19                      // this regex also looks for a commonly abused phrase starting with 'meta', followed by a phrase, then 'team' with no separating spaces.
 20                      '\bm.?e.?t.?a(?:recruiting|pro|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|service|account|help|support|business|policy|ads)team',
 21  
 22                      // this regex is similar to the first in this section, but starts with facebook instead of meta
 23                      '\bf.?a.?c.?e.?b.?o.?o.?k\b.*(?:verif(?:y|i(?:cado|ed)))?.*\b(?:recruiting|ads[ -]?team|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|service|account|help|support|business|policy|Vérifié|certify|inc|help[ -]?desk)\b',
 24                      '^[a-z]+ from \bmeta$',
 25                      'page ?ads ?support',
 26                      'Instagram\s*(?:Not|Policies|Report|Helpdesk|Support)',
 27                      '\bMeta & Coursera',
 28                      'Compliance & Security',
 29                      'social.?media.?\b(?:master|expert|pro|guru)\b',
 30                      '\bmeta\b.?(?:social|skill|ads).?(?:star|set|expert)',
 31                      'noreply-(?:meta|fb).+',
 32                      '(?:meta|facebook|fb|instagram|ig)[-\s]verif'
 33      )
 34      or (
 35        regex.icontains(sender.display_name,
 36                        "f\u{200a}?a\u{200a}?c\u{200a}?e\u{200a}?b\u{200a}?o\u{200a}?o\u{200a}?k"
 37        )
 38        and not strings.icontains(sender.display_name, 'facebook')
 39      )
 40      or strings.contains(sender.display_name, "\u{24C2}")
 41      or strings.ilevenshtein(sender.display_name, 'facebook ads') <= 2
 42      or strings.ilevenshtein(sender.display_name, 'facebook business') <= 2
 43      or strings.ilike(sender.email.domain.domain, '*facebook*', "ig-support*")
 44      or strings.ilike(sender.email.local_part,
 45                       "*instagramlive*",
 46                       "*facebooksupport*"
 47      )
 48      or strings.icontains(sender.email.domain.subdomain, 'meta-')
 49      or (
 50        regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*meta\b')
 51        and strings.count(body.current_thread.text, '©') == 1
 52      )
 53    )
 54    // the use of these keywords (facebook, instagram)
 55    // or the levenshtein distance to facebook
 56    // are less strong and thus need to be combined with logo detection or nlu
 57    or (
 58      (
 59        regex.icontains(sender.display_name,
 60                        '\bf[\p{Mn}\p{Cf}]*a[\p{Mn}\p{Cf}]*c[\p{Mn}\p{Cf}]*e[\p{Mn}\p{Cf}]*b[\p{Mn}\p{Cf}]*o[\p{Mn}\p{Cf}]*o[\p{Mn}\p{Cf}]*k[\p{Mn}\p{Cf}]*\b',
 61                        '\binstagr(am)?\b',
 62                        '\bm[\p{Mn}\p{Cf}]*e[\p{Mn}\p{Cf}]*t[\p{Mn}\p{Cf}]*a\b'
 63        )
 64        or strings.ilevenshtein(sender.display_name, 'facebook') <= 2
 65        or sender.email.email == 'noreply@appsheet.com'
 66      )
 67      and 2 of (
 68        any(ml.logo_detect(file.message_screenshot()).brands,
 69            .name in ("Facebook", "Meta", "Instagram", "Threads")
 70        ),
 71        any(ml.nlu_classifier(body.current_thread.text).intents,
 72            .name in ("cred_theft", "callback_scam", "steal_pii")
 73            and .confidence in ("medium", "high")
 74        ),
 75        (
 76          length(body.current_thread.text) < 2000
 77          and regex.icontains(body.current_thread.text, "(?:violation|infringe)")
 78        ),
 79        regex.icontains(subject.base,
 80                        '\b(?:recruiting|permanently|locked|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|account|help|support|business|policy|verif(?:y|i(?:cado|ed))|Vérifié|Trademark|Misuse|Review|Violation|Warning|Restriction|Inappropriate|service|Content|multiple reports)\b'
 81        ),
 82        any(body.links,
 83            .href_url.domain.root_domain in $self_service_creation_platform_domains
 84            or .href_url.domain.root_domain in $free_file_hosts
 85            or .href_url.domain.root_domain in $free_subdomain_hosts
 86            or .href_url.domain.root_domain in $url_shorteners
 87        ),
 88        sender.email.domain.root_domain in $free_email_providers
 89      )
 90    )
 91    // salesforce sender combined with logo detection and nlu is enough
 92    or (
 93      sender.email.domain.root_domain == "salesforce.com"
 94      and any(ml.logo_detect(file.message_screenshot()).brands,
 95              .name in ("Facebook", "Meta", "Instagram", "Threads")
 96      )
 97      and any(ml.nlu_classifier(body.current_thread.text).intents,
 98              .name in ("cred_theft", "callback_scam", "steal_pii")
 99              and .confidence in ("medium", "high")
100      )
101    )
102    or 
103    // or the body contains a facebook/meta footer with the address citing "community support"
104    (
105      (
106        regex.icontains(body.current_thread.text,
107                        '(?:1\s+(?:Facebook|Hacker|Meta)?\s*Way|1601\s+Willow\s+Rd?).*Menlo\s+Park.*CA.*94025'
108        )
109        or (
110          regex.icontains(body.current_thread.text,
111                          '(?:Security Team © Meta|Meta Support Team)'
112          )
113        )
114      )
115      // and it contains a link to spawn a chat with facebook - this is not the way support operates
116      and (
117        any(body.links,
118            strings.ends_with(.href_url.domain.domain, 'facebook.com')
119            and strings.starts_with(.href_url.path, '/msg/')
120        )
121        or (
122          any(ml.nlu_classifier(body.current_thread.text).intents,
123              .name in ("cred_theft", "callback_scam", "steal_pii")
124              and .confidence in ("high")
125          )
126        )
127        or any(recipients.to,
128               .email.domain.valid
129               and any(body.links,
130                       strings.icontains(.href_url.url, ..email.email)
131                       or any(strings.scan_base64(.href_url.url,
132                                                  format="url",
133                                                  ignore_padding=true
134                              ),
135                              strings.icontains(., ...email.email)
136                       )
137                       or any(strings.scan_base64(.href_url.fragment,
138                                                  ignore_padding=true
139                              ),
140                              strings.icontains(., ...email.email)
141                       )
142               )
143        )
144      )
145    )
146    // we've seen advertising "advice/recommendations"
147    or (
148      all(ml.nlu_classifier(body.current_thread.text).topics,
149          .name in ("Advertising and Promotions", "Reminders and Notifications")
150      )
151      // Meta mention
152      and (
153        any(ml.nlu_classifier(body.current_thread.text).entities,
154            .name == "org" and strings.icontains(.text, 'Community Guidelines')
155        )
156        or regex.icontains(body.current_thread.text,
157                           '(1\s+(Facebook|Hacker|\bMeta\b)?\s*Way|1601\s+Willow\s+Rd?).*Menlo\s+Park.*CA.*94025'
158        )
159      )
160      and any(ml.nlu_classifier(body.current_thread.text).entities,
161              .name == "urgency"
162      )
163    )
164    or (
165      strings.icontains(body.current_thread.text, "Meta Professional Certificate")
166      and strings.icontains(body.current_thread.text, "Meta & Coursera Team")
167      // Add link validation
168      and any(body.links,
169              strings.icontains(.display_text, "coursera")
170              and .href_url.domain.root_domain != "coursera.org"
171      )
172    )
173    or 2 of (
174      strings.icontains(body.current_thread.text, 'Meta '),
175      strings.icontains(body.current_thread.text, '1602 Willow Road'),
176      strings.icontains(body.current_thread.text, 'Menlo Park, CA 91024'),
177    )
178  )
179  and sender.email.domain.root_domain not in~ (
180    'facebook.com',
181    'facebookmail.com',
182    'eventsatfacebook.com',
183    'facebookenterprise.com',
184    'meta.com',
185    'metamail.com',
186    'instagram.com',
187    'medallia.com',
188    'fbworkmail.com',
189    'workplace.com',
190    'capterra.com', // they mention "Community Guidelines"
191    'facebookblueprint.com',
192    'metaenterprisemail.com',
193    'pigfacebookstore.com.au', // unrelated domain but hitting on facebook
194    'metacompliance.com',
195    'metaprop.com', // unrelated domain but hitting on meta pro
196    'oakley.com', // meta intelligence glasses
197    'facebookuserprivacysettlement.com', // fb settlement website
198    'perceptyx.com', // ai employee engagement
199    'unroll.me', // unroll contains instagram logo
200    'har.com' // facebook ads management
201  )
202  // negate metaenterprise links
203  and not any(headers.reply_to, .email.email == "noreply@facebookmail.com")
204  
205  // meta wiki renamer
206  and not (
207    sender.display_name == 'Meta-Wiki'
208    and sender.email.domain.root_domain == 'wikimedia.org'
209  )
210  
211  // we dont want emails where all the links go to meta domains
212  and not (
213    (
214      length(body.links) > 1
215      and all(body.links,
216              .href_url.domain.root_domain in (
217                'facebook.com',
218                'instagram.com',
219                'meta.com'
220              )
221              and not strings.istarts_with(.href_url.path, '/share/')
222      )
223    )
224    // too many links
225    or length(body.links) > 20
226  )
227  
228  // no previous threads
229  and length(body.previous_threads) == 0
230  
231  // negate highly trusted sender domains unless they fail DMARC authentication
232  and (
233    (
234      sender.email.domain.root_domain in $high_trust_sender_root_domains
235      and not headers.auth_summary.dmarc.pass
236    )
237    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
238  
239    // salesforce has been abused for meta phishing campaigns repeatedly
240    or sender.email.domain.root_domain == "salesforce.com"
241  )  
242attack_types:
243  - "Credential Phishing"
244tactics_and_techniques:
245  - "Impersonation: Brand"
246  - "Lookalike domain"
247  - "Social engineering"
248detection_methods:
249  - "Header analysis"
250  - "Sender analysis"
251id: "e38f1e3b-79be-5a59-b084-24a851daf6b9"
to-top