Brand impersonation: MyChart

 1name: "Brand impersonation: MyChart"
 2description: "Detects inbound messages impersonating MyChart, the patient portal brand, by using a display name containing 'mychart' combined with common lure phrases such as 'claim your reward', 'member rewards', 'feedback survey', or 'medicare kit'. The rule also flags messages sent from recently registered domains. Legitimate senders from trusted MyChart-related domains that pass DMARC authentication, as well as designated high-trust sender domains, are excluded."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    strings.icontains(sender.display_name, "mychart")
 9    or any(ml.nlu_classifier(body.current_thread.text).entities,
10           .name == "org" and strings.icontains(.text, 'mychart medicare kit')
11    )
12    or (
13      any(html.xpath(body.html, '//title').nodes,
14          strings.icontains(.raw, 'mychart')
15      )
16      and any(recipients.to,
17              strings.icontains(body.current_thread.text, .email.local_part)
18      )
19    )
20  )
21  and (
22    (
23      strings.icontains(body.current_thread.text, "mychart")
24      and 2 of (
25        strings.icontains(body.current_thread.text, "claim your reward"),
26        strings.icontains(body.current_thread.text, "feedback survey"),
27        strings.icontains(body.current_thread.text, "invited to participate"),
28        strings.icontains(body.current_thread.text, "medicare kit"),
29        strings.icontains(body.current_thread.text, "member rewards"),
30        strings.icontains(body.current_thread.text, "member appreciation"),
31        strings.icontains(body.current_thread.text, "log in to mychart"),
32        strings.icontains(body.current_thread.text, 'securesign'),
33        regex.icontains(body.current_thread.text, '©\s*(?:\d+)\s*mychart')
34      )
35    )
36    or strings.icontains(subject.base, "medicare kit")
37    or regex.icontains(subject.base, '[a-f0-9]{32}\b')
38    or network.whois(sender.email.domain).days_old < 365
39    or sender.email.domain.root_domain in $free_email_providers
40  )
41  and not (
42    sender.email.domain.root_domain in (
43      "epic-notification.com",
44      "myhealthconnect.org",
45      "optum.com"
46    )
47    and coalesce(headers.auth_summary.dmarc.pass, false)
48  )
49  // negate highly trusted sender domains unless they fail DMARC authentication
50  and not (
51    sender.email.domain.root_domain in $high_trust_sender_root_domains
52    and coalesce(headers.auth_summary.dmarc.pass, false)
53  )  
54attack_types:
55  - "Credential Phishing"
56  - "Spam"
57tactics_and_techniques:
58  - "Impersonation: Brand"
59  - "Social engineering"
60  - "Spoofing"
61detection_methods:
62  - "Content analysis"
63  - "Natural Language Understanding"
64  - "Header analysis"
65  - "Sender analysis"
66id: "8be6743d-8d17-53ef-97c7-cb00f2b27374"