Brand impersonation: Meta and subsidiaries

Impersonation of Meta or Meta's subsidiaries Facebook and Instagram.

Sublime rule (View on GitHub)

  1name: "Brand impersonation: Meta and subsidiaries"
  2description: |
  3    Impersonation of Meta or Meta's subsidiaries Facebook and Instagram.
  4references:
  5  - "https://www.techrepublic.com/article/google-and-amazon-most-impersonated-brands-in-phishing-attacks/"
  6type: "rule"
  7severity: "medium"
  8source: |
  9  type.inbound
 10  and (
 11    // sender display name is a strong enough indicator
 12    // that it can be used without any other impersonation logic
 13    (
 14      regex.icontains(sender.display_name,
 15  
 16                      // this regex looks for a commonly abused phrase starting with 'meta', potentially containing a version of the word 'verified', followed by phrases that have been observed in campaigns.
 17                      '\bm.?e.?t.?a\b.*(?:verif(?:y|i(?:cado|ed)))?.*\b(?:recruiting|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|account|help|support|service|business|policy|Vérifié|certify|inc|help[ -]?desk)\b',
 18  
 19                      // this regex also looks for a commonly abused phrase starting with 'meta', followed by a phrase, then 'team' with no separating spaces.
 20                      '\bm.?e.?t.?a(?:recruiting|pro|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|service|account|help|support|business|policy|ads)(?:team|support)',
 21  
 22                      // this regex is similar to the first in this section, but starts with facebook instead of meta
 23                      '\bf.?a.?c.?e.?b.?o.?o.?k\b.*(?:verif(?:y|i(?:cado|ed)))?.*\b(?:recruiting|ads[ -]?team|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|service|account|help|support|business|policy|Vérifié|certify|inc|help[ -]?desk)\b',
 24                      '^[a-z]+ from \bmeta$',
 25                      'page ?ads ?support',
 26                      'Instagram\s*(?:Not|Policies|Report|Helpdesk|Support)',
 27                      '\bMeta & Coursera',
 28                      'Compliance & Security',
 29                      'social.?media.?\b(?:master|expert|pro|guru)\b',
 30                      '\bmeta\b.?(?:social|skill|ads).?(?:star|set|expert)',
 31                      'noreply-(?:meta|fb).+',
 32                      '(?:meta|facebook|fb|instagram|ig)[-\s]verif',
 33                      'meta\S{0,10}center'
 34      )
 35      or (
 36        regex.icontains(sender.display_name,
 37                        "f\u{200a}?a\u{200a}?c\u{200a}?e\u{200a}?b\u{200a}?o\u{200a}?o\u{200a}?k"
 38        )
 39        and not strings.icontains(sender.display_name, 'facebook')
 40      )
 41      or strings.contains(sender.display_name, "\u{24C2}")
 42      or strings.ilevenshtein(sender.display_name, 'facebook ads') <= 2
 43      or strings.ilevenshtein(sender.display_name, 'facebook business') <= 2
 44      or strings.ilike(sender.email.domain.domain, '*facebook*', "ig-support*")
 45      or strings.ilike(sender.email.local_part,
 46                       "*instagramlive*",
 47                       "*facebooksupport*"
 48      )
 49      or strings.icontains(sender.email.domain.subdomain, 'meta-')
 50      or (
 51        regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*meta\b')
 52        and strings.count(body.current_thread.text, '©') == 1
 53      )
 54    )
 55    // the use of these keywords (facebook, instagram)
 56    // or the levenshtein distance to facebook
 57    // are less strong and thus need to be combined with logo detection or nlu
 58    or (
 59      (
 60        regex.icontains(sender.display_name,
 61                        '\bf[\p{Mn}\p{Cf}]*a[\p{Mn}\p{Cf}]*c[\p{Mn}\p{Cf}]*e[\p{Mn}\p{Cf}]*b[\p{Mn}\p{Cf}]*o[\p{Mn}\p{Cf}]*o[\p{Mn}\p{Cf}]*k[\p{Mn}\p{Cf}]*\b',
 62                        '\binstagr(am)?\b',
 63                        '\bm[\p{Mn}\p{Cf}]*e[\p{Mn}\p{Cf}]*t[\p{Mn}\p{Cf}]*a\b'
 64        )
 65        or strings.ilevenshtein(sender.display_name, 'facebook') <= 2
 66        or sender.email.email == 'noreply@appsheet.com'
 67      )
 68      and 2 of (
 69        any(ml.logo_detect(file.message_screenshot()).brands,
 70            .name in ("Facebook", "Meta", "Instagram", "Threads")
 71        ),
 72        any(ml.nlu_classifier(body.current_thread.text).intents,
 73            .name in ("cred_theft", "callback_scam", "steal_pii")
 74            and .confidence in ("medium", "high")
 75        ),
 76        (
 77          length(body.current_thread.text) < 2000
 78          and regex.icontains(body.current_thread.text, "(?:violation|infringe)")
 79        ),
 80        regex.icontains(subject.base,
 81                        '\b(?:recruiting|permanently|locked|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|account|help|support|business|policy|verif(?:y|i(?:cado|ed))|Vérifié|Trademark|Misuse|Review|Violation|Warning|Restriction|Inappropriate|service|Content|multiple reports)\b'
 82        ),
 83        any(body.links,
 84            .href_url.domain.root_domain in $self_service_creation_platform_domains
 85            or .href_url.domain.root_domain in $free_file_hosts
 86            or .href_url.domain.root_domain in $free_subdomain_hosts
 87            or .href_url.domain.root_domain in $url_shorteners
 88        ),
 89        sender.email.domain.root_domain in $free_email_providers
 90      )
 91    )
 92    // salesforce sender combined with logo detection and nlu is enough
 93    or (
 94      sender.email.domain.root_domain == "salesforce.com"
 95      and any(ml.logo_detect(file.message_screenshot()).brands,
 96              .name in ("Facebook", "Meta", "Instagram", "Threads")
 97      )
 98      and any(ml.nlu_classifier(body.current_thread.text).intents,
 99              .name in ("cred_theft", "callback_scam", "steal_pii")
100              and .confidence in ("medium", "high")
101      )
102    )
103    or 
104    // or the body contains a facebook/meta footer with the address citing "community support"
105    (
106      (
107        regex.icontains(body.current_thread.text,
108                        '(?:1\s+(?:Facebook|Hacker|Meta)?\s*Way|1601\s+Willow\s+Rd?).*Menlo\s+Park.*CA.*94025'
109        )
110        or (
111          regex.icontains(body.current_thread.text,
112                          '(?:Security Team © Meta|Meta Support Team)'
113          )
114        )
115      )
116      // and it contains a link to spawn a chat with facebook - this is not the way support operates
117      and (
118        any(body.links,
119            strings.ends_with(.href_url.domain.domain, 'facebook.com')
120            and strings.starts_with(.href_url.path, '/msg/')
121        )
122        or (
123          any(ml.nlu_classifier(body.current_thread.text).intents,
124              .name in ("cred_theft", "callback_scam", "steal_pii")
125              and .confidence in ("high")
126          )
127        )
128        or any(recipients.to,
129               .email.domain.valid
130               and any(body.links,
131                       strings.icontains(.href_url.url, ..email.email)
132                       or any(strings.scan_base64(.href_url.url,
133                                                  format="url",
134                                                  ignore_padding=true
135                              ),
136                              strings.icontains(., ...email.email)
137                       )
138                       or any(strings.scan_base64(.href_url.fragment,
139                                                  ignore_padding=true
140                              ),
141                              strings.icontains(., ...email.email)
142                       )
143               )
144        )
145      )
146    )
147    // we've seen advertising "advice/recommendations"
148    or (
149      all(ml.nlu_classifier(body.current_thread.text).topics,
150          .name in ("Advertising and Promotions", "Reminders and Notifications")
151      )
152      // Meta mention
153      and (
154        any(ml.nlu_classifier(body.current_thread.text).entities,
155            .name == "org" and strings.icontains(.text, 'Community Guidelines')
156        )
157        or regex.icontains(body.current_thread.text,
158                           '(1\s+(Facebook|Hacker|\bMeta\b)?\s*Way|1601\s+Willow\s+Rd?).*Menlo\s+Park.*CA.*94025'
159        )
160      )
161      and any(ml.nlu_classifier(body.current_thread.text).entities,
162              .name == "urgency"
163      )
164    )
165    or (
166      strings.icontains(body.current_thread.text, "Meta Professional Certificate")
167      and strings.icontains(body.current_thread.text, "Meta & Coursera Team")
168      // Add link validation
169      and any(body.links,
170              strings.icontains(.display_text, "coursera")
171              and .href_url.domain.root_domain != "coursera.org"
172      )
173    )
174    or 2 of (
175      strings.icontains(body.current_thread.text, 'Meta '),
176      strings.icontains(body.current_thread.text, '1602 Willow Road'),
177      strings.icontains(body.current_thread.text, 'Menlo Park, CA 91024'),
178    )
179  )
180  and sender.email.domain.root_domain not in~ (
181    'facebook.com',
182    'facebookmail.com',
183    'eventsatfacebook.com',
184    'facebookenterprise.com',
185    'meta.com',
186    'metamail.com',
187    'instagram.com',
188    'medallia.com',
189    'fbworkmail.com',
190    'workplace.com',
191    'capterra.com', // they mention "Community Guidelines"
192    'facebookblueprint.com',
193    'metaenterprisemail.com',
194    'pigfacebookstore.com.au', // unrelated domain but hitting on facebook
195    'metacompliance.com',
196    'metaprop.com', // unrelated domain but hitting on meta pro
197    'oakley.com', // meta intelligence glasses
198    'facebookuserprivacysettlement.com', // fb settlement website
199    'perceptyx.com', // ai employee engagement
200    'unroll.me', // unroll contains instagram logo
201    'har.com' // facebook ads management
202  )
203  // negate metaenterprise links
204  and not any(headers.reply_to, .email.email == "noreply@facebookmail.com")
205  
206  // meta wiki renamer
207  and not (
208    sender.display_name == 'Meta-Wiki'
209    and sender.email.domain.root_domain == 'wikimedia.org'
210  )
211  
212  // we dont want emails where all the links go to meta domains
213  and not (
214    (
215      length(body.links) > 1
216      and all(body.links,
217              .href_url.domain.root_domain in (
218                'facebook.com',
219                'instagram.com',
220                'meta.com'
221              )
222              and not strings.istarts_with(.href_url.path, '/share/')
223      )
224    )
225    // too many links
226    or length(body.links) > 20
227  )
228  
229  // no previous threads
230  and length(body.previous_threads) == 0
231  
232  // negate highly trusted sender domains unless they fail DMARC authentication
233  and (
234    (
235      sender.email.domain.root_domain in $high_trust_sender_root_domains
236      and not headers.auth_summary.dmarc.pass
237    )
238    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
239  
240    // salesforce has been abused for meta phishing campaigns repeatedly
241    or sender.email.domain.root_domain == "salesforce.com"
242  )  
243attack_types:
244  - "Credential Phishing"
245tactics_and_techniques:
246  - "Impersonation: Brand"
247  - "Lookalike domain"
248  - "Social engineering"
249detection_methods:
250  - "Header analysis"
251  - "Sender analysis"
252id: "e38f1e3b-79be-5a59-b084-24a851daf6b9"
to-top