Brand impersonation: Meta and subsidiaries
Impersonation of Meta or Meta's subsidiaries Facebook and Instagram.
Sublime rule (View on GitHub)
1name: "Brand impersonation: Meta and subsidiaries"
2description: |
3 Impersonation of Meta or Meta's subsidiaries Facebook and Instagram.
4references:
5 - "https://www.techrepublic.com/article/google-and-amazon-most-impersonated-brands-in-phishing-attacks/"
6type: "rule"
7severity: "medium"
8source: |
9 type.inbound
10 and (
11 // sender display name is a strong enough indicator
12 // that it can be used without any other impersonation logic
13 (
14 regex.icontains(sender.display_name,
15
16 // this regex looks for a commonly abused phrase starting with 'meta', potentially containing a version of the word 'verified', followed by phrases that have been observed in campaigns.
17 '\bm.?e.?t.?a\b.*(?:verif(?:y|i(?:cado|ed)))?.*\b(?:recruiting|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|account|help|support|service|business|policy|Vérifié|certify|inc|help[ -]?desk)\b',
18
19 // this regex also looks for a commonly abused phrase starting with 'meta', followed by a phrase, then 'team' with no separating spaces.
20 '\bm.?e.?t.?a(?:recruiting|pro|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|service|account|help|support|business|policy|ads)(?:team|support)',
21
22 // this regex is similar to the first in this section, but starts with facebook instead of meta
23 '\bf.?a.?c.?e.?b.?o.?o.?k\b.*(?:verif(?:y|i(?:cado|ed)))?.*\b(?:recruiting|ads[ -]?team|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|service|account|help|support|business|policy|Vérifié|certify|inc|help[ -]?desk)\b',
24 '^[a-z]+ from \bmeta$',
25 'page ?ads ?support',
26 'Instagram\s*(?:Not|Policies|Report|Helpdesk|Support)',
27 '\bMeta & Coursera',
28 'Compliance & Security',
29 'social.?media.?\b(?:master|expert|pro|guru)\b',
30 '\bmeta\b.?(?:social|skill|ads).?(?:star|set|expert)',
31 'noreply-(?:meta|fb).+',
32 '(?:meta|facebook|fb|instagram|ig)[-\s]?verif',
33 'meta\S{0,10}center'
34 )
35 or (
36 regex.icontains(sender.display_name,
37 "f\u{200a}?a\u{200a}?c\u{200a}?e\u{200a}?b\u{200a}?o\u{200a}?o\u{200a}?k"
38 )
39 and not strings.icontains(sender.display_name, 'facebook')
40 )
41 or strings.contains(sender.display_name, "\u{24C2}")
42 or strings.ilevenshtein(sender.display_name, 'facebook ads') <= 2
43 or strings.ilevenshtein(sender.display_name, 'facebook business') <= 2
44 or strings.ilike(sender.email.domain.domain, '*facebook*', "ig-support*")
45 or strings.ilike(sender.email.local_part,
46 "*instagramlive*",
47 "*facebooksupport*"
48 )
49 or strings.icontains(sender.email.domain.subdomain, 'meta-')
50 or (
51 regex.icontains(body.current_thread.text,
52 '©\s*(?:\d+)\s*meta\b',
53 '©\s*instagram\s+from\s+meta\b'
54 )
55 and strings.count(body.current_thread.text, '©') == 1
56 )
57 or (
58 any(html.xpath(body.html, '//h2 | //h1').nodes,
59 regex.icontains(strings.replace_confusables(.display_text),
60 'meta\s+verified'
61 )
62 )
63 and any(body.current_thread.links,
64 .href_url.domain.root_domain in $free_subdomain_hosts
65 )
66 )
67 )
68 // the use of these keywords (facebook, instagram)
69 // or the levenshtein distance to facebook
70 // are less strong and thus need to be combined with logo detection or nlu
71 or (
72 (
73 regex.icontains(sender.display_name,
74 '\bf[\p{Mn}\p{Cf}]*a[\p{Mn}\p{Cf}]*c[\p{Mn}\p{Cf}]*e[\p{Mn}\p{Cf}]*b[\p{Mn}\p{Cf}]*o[\p{Mn}\p{Cf}]*o[\p{Mn}\p{Cf}]*k[\p{Mn}\p{Cf}]*\b',
75 '\binstagr(am)?\b',
76 '\bm[\p{Mn}\p{Cf}]*e[\p{Mn}\p{Cf}]*t[\p{Mn}\p{Cf}]*a\b'
77 )
78 or strings.ilevenshtein(sender.display_name, 'facebook') <= 2
79 or sender.email.email == 'noreply@appsheet.com'
80 )
81 and 2 of (
82 any(ml.logo_detect(file.message_screenshot()).brands,
83 .name in ("Facebook", "Meta", "Instagram", "Threads")
84 ),
85 any(ml.nlu_classifier(body.current_thread.text).intents,
86 .name in ("cred_theft", "callback_scam", "steal_pii")
87 and .confidence in ("medium", "high")
88 ),
89 (
90 length(body.current_thread.text) < 2000
91 and regex.icontains(body.current_thread.text, "(?:violation|infringe)")
92 ),
93 regex.icontains(subject.base,
94 '\b(?:recruiting|permanently|locked|certification|trust|safety|badge|alert|advertising|compliance|copyright|enforcement|intellectual|rights|account|help|support|business|policy|verif(?:y|i(?:cado|ed))|Vérifié|Trademark|Misuse|Review|Violation|Warning|Restriction|Inappropriate|service|Content|multiple reports)\b'
95 ),
96 any(body.links,
97 .href_url.domain.root_domain in $self_service_creation_platform_domains
98 or .href_url.domain.root_domain in $free_file_hosts
99 or .href_url.domain.root_domain in $free_subdomain_hosts
100 or .href_url.domain.root_domain in $url_shorteners
101 ),
102 sender.email.domain.root_domain in $free_email_providers
103 )
104 )
105 // salesforce sender combined with logo detection and nlu is enough
106 or (
107 sender.email.domain.root_domain == "salesforce.com"
108 and any(ml.logo_detect(file.message_screenshot()).brands,
109 .name in ("Facebook", "Meta", "Instagram", "Threads")
110 )
111 and any(ml.nlu_classifier(body.current_thread.text).intents,
112 .name in ("cred_theft", "callback_scam", "steal_pii")
113 and .confidence in ("medium", "high")
114 )
115 )
116 or
117 // or the body contains a facebook/meta footer with the address citing "community support"
118 (
119 (
120 regex.icontains(body.current_thread.text,
121 '(?:1\s+(?:Facebook|Hacker|Meta)?\s*Way|1601\s+Willow\s+Rd?).*Menlo\s+Park.*CA.*94025'
122 )
123 or (
124 regex.icontains(body.current_thread.text,
125 '(?:Security Team © Meta|Meta Support Team)'
126 )
127 )
128 )
129 // and it contains a link to spawn a chat with facebook - this is not the way support operates
130 and (
131 any(body.links,
132 strings.ends_with(.href_url.domain.domain, 'facebook.com')
133 and strings.starts_with(.href_url.path, '/msg/')
134 )
135 or (
136 any(ml.nlu_classifier(body.current_thread.text).intents,
137 .name in ("cred_theft", "callback_scam", "steal_pii")
138 and .confidence in ("high")
139 )
140 )
141 or any(recipients.to,
142 .email.domain.valid
143 and any(body.links,
144 strings.icontains(.href_url.url, ..email.email)
145 or any(strings.scan_base64(.href_url.url,
146 format="url",
147 ignore_padding=true
148 ),
149 strings.icontains(., ...email.email)
150 )
151 or any(strings.scan_base64(.href_url.fragment,
152 ignore_padding=true
153 ),
154 strings.icontains(., ...email.email)
155 )
156 )
157 )
158 )
159 )
160 // we've seen advertising "advice/recommendations"
161 or (
162 all(ml.nlu_classifier(body.current_thread.text).topics,
163 .name in ("Advertising and Promotions", "Reminders and Notifications")
164 )
165 // Meta mention
166 and (
167 any(ml.nlu_classifier(body.current_thread.text).entities,
168 .name == "org" and strings.icontains(.text, 'Community Guidelines')
169 )
170 or regex.icontains(body.current_thread.text,
171 '(1\s+(Facebook|Hacker|\bMeta\b)?\s*Way|1601\s+Willow\s+Rd?).*Menlo\s+Park.*CA.*94025'
172 )
173 )
174 and any(ml.nlu_classifier(body.current_thread.text).entities,
175 .name == "urgency"
176 )
177 )
178 or (
179 strings.icontains(body.current_thread.text, "Meta Professional Certificate")
180 and strings.icontains(body.current_thread.text, "Meta & Coursera Team")
181 // Add link validation
182 and any(body.links,
183 strings.icontains(.display_text, "coursera")
184 and .href_url.domain.root_domain != "coursera.org"
185 )
186 )
187 or 2 of (
188 strings.icontains(body.current_thread.text, 'Meta '),
189 strings.icontains(body.current_thread.text, '1602 Willow Road'),
190 strings.icontains(body.current_thread.text, 'Menlo Park, CA 91024'),
191 )
192 )
193 and sender.email.domain.root_domain not in~ (
194 'facebook.com',
195 'facebookmail.com',
196 'eventsatfacebook.com',
197 'facebookenterprise.com',
198 'meta.com',
199 'metamail.com',
200 'instagram.com',
201 'medallia.com',
202 'fbworkmail.com',
203 'workplace.com',
204 'capterra.com', // they mention "Community Guidelines"
205 'facebookblueprint.com',
206 'metaenterprisemail.com',
207 'pigfacebookstore.com.au', // unrelated domain but hitting on facebook
208 'metacompliance.com',
209 'metaprop.com', // unrelated domain but hitting on meta pro
210 'oakley.com', // meta intelligence glasses
211 'facebookuserprivacysettlement.com', // fb settlement website
212 'perceptyx.com', // ai employee engagement
213 'unroll.me', // unroll contains instagram logo
214 'har.com' // facebook ads management
215 )
216 // negate metaenterprise links
217 and not any(headers.reply_to, .email.email == "noreply@facebookmail.com")
218
219 // meta wiki renamer
220 and not (
221 sender.display_name == 'Meta-Wiki'
222 and sender.email.domain.root_domain == 'wikimedia.org'
223 )
224
225 // we dont want emails where all the links go to meta domains
226 and not (
227 (
228 length(body.links) > 1
229 and all(body.links,
230 .href_url.domain.root_domain in (
231 'facebook.com',
232 'instagram.com',
233 'meta.com'
234 )
235 and not strings.istarts_with(.href_url.path, '/share/')
236 )
237 )
238 // too many links
239 or length(body.links) > 20
240 )
241
242 // no previous threads
243 and length(body.previous_threads) == 0
244
245 // negate highly trusted sender domains unless they fail DMARC authentication
246 and (
247 (
248 sender.email.domain.root_domain in $high_trust_sender_root_domains
249 and not headers.auth_summary.dmarc.pass
250 )
251 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
252
253 // salesforce has been abused for meta phishing campaigns repeatedly
254 or sender.email.domain.root_domain == "salesforce.com"
255 )
256attack_types:
257 - "Credential Phishing"
258tactics_and_techniques:
259 - "Impersonation: Brand"
260 - "Lookalike domain"
261 - "Social engineering"
262detection_methods:
263 - "Header analysis"
264 - "Sender analysis"
265id: "e38f1e3b-79be-5a59-b084-24a851daf6b9"