Brand impersonation: Netflix

  1name: "Brand impersonation: Netflix"
  2description: |
  3    Impersonation of Netflix.
  4references:
  5  - "https://news.trendmicro.com/2023/01/18/netflix-scams-2023-job-text-email/"
  6type: "rule"
  7severity: "low"
  8authors:
  9  - name: "min0k"
 10source: |
 11  type.inbound
 12  and (
 13    // obfuscated sender display name
 14    (
 15      sender.display_name is not null
 16      and (
 17        regex.icontains(strings.replace_confusables(sender.display_name),
 18                        '[nm]etf[li][il]x'
 19        )
 20        or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
 21                                'netflix'
 22        ) <= 1
 23        or regex.icontains(strings.replace_confusables(sender.display_name),
 24                           'n.{0,3}e.{0,3}t.{0,3}f.{0,3}l.{0,3}i.{0,3}x.{0,3}'
 25        )
 26      )
 27    )
 28    // Netflix reactivate subscription
 29    or (
 30      strings.icontains(subject.base, "netflix")
 31      and regex.icontains(body.current_thread.text,
 32                          'reactivate\s+(your\s+)?subscription'
 33      )
 34    )
 35    or (
 36      strings.icontains(strings.replace_confusables(body.current_thread.text),
 37                        'netplusflix'
 38      )
 39      and strings.count(body.current_thread.text, '©') == 1
 40    )
 41    // obfuscated sender email domain
 42    or regex.icontains(strings.replace_confusables(sender.email.domain.domain),
 43                       '[nm]etf[li][il]x'
 44    )
 45    // logo detection on message screenshot (no link analysis)
 46    or (
 47      any(ml.logo_detect(file.message_screenshot()).brands,
 48          .name == "Netflix" and .confidence in ("medium", "high")
 49      )
 50      and (
 51        // non NLU based keywords on the screenshot
 52        regex.icontains(beta.ocr(file.message_screenshot()).text,
 53                        'suspen(?:ded|sion)'
 54        )
 55        or 
 56        // combo of NLU cred_theft + financial + Customer Service and Support
 57        (
 58          any(ml.nlu_classifier(body.current_thread.text).intents,
 59              .name == "cred_theft"
 60          )
 61          and any(ml.nlu_classifier(body.current_thread.text).entities,
 62                  .name == "financial"
 63          )
 64          and any(ml.nlu_classifier(body.current_thread.text).topics,
 65                  .name == "Customer Service and Support"
 66          )
 67        )
 68      )
 69    )
 70    // Address Detection
 71    or 2 of (
 72      strings.icontains(body.current_thread.text, 'Netflix, Inc'),
 73      strings.icontains(body.current_thread.text, '100 Winchester Circle'),
 74      strings.icontains(body.current_thread.text, 'Los Gatos, CA 95032')
 75    )
 76    // unusual recipient pattern + logo detect + credphish dispoistion
 77    or (
 78      (
 79        length(recipients.to) == 0
 80        or (
 81          all(recipients.to, .email.domain.valid == false)
 82          and all(recipients.cc, .email.domain.valid == false)
 83        )
 84      )
 85      and any(ml.logo_detect(file.message_screenshot()).brands,
 86              .name == "Netflix" and .confidence in ("medium", "high")
 87      )
 88      and (
 89        any(body.links,
 90            ml.link_analysis(.).credphish.disposition == "phishing"
 91            and ml.link_analysis(.).credphish.confidence in ("medium", "high")
 92        )
 93      )
 94    )
 95  )
 96  // negation of legit domains
 97  and not (
 98    sender.email.domain.root_domain in (
 99      'netflix.com',
100      'dvd.com',
101      'netflixfamily.com',
102      'netflixpreviewclub.com',
103      'netflixanimation.com',
104      'envoy.com',
105      'lexisnexis.com',
106      'netflix.shop',
107      'netflixcontractors.com', // owned by netflix
108      'netflixevents.com', // owned by netflix
109      'netelixir.com', // unrelated marketing
110      'netflixhouse.com', // owned by netflix
111      'instagram.com',
112      'netflix.net',
113      'netflixshopsupport.com', // owned by netflix
114      'netflixpartner.com', // owned by netflix
115    )
116    and coalesce(headers.auth_summary.dmarc.pass, false)
117  )
118  and not (
119    sender.email.domain.domain in (
120      'netflix.zendesk.com' // netflix actual support
121    )
122    and coalesce(headers.auth_summary.dmarc.pass, false)
123  )
124  and not profile.by_sender_email().solicited  
125attack_types:
126  - "Credential Phishing"
127tactics_and_techniques:
128  - "Impersonation: Brand"
129  - "Lookalike domain"
130  - "Social engineering"
131detection_methods:
132  - "Header analysis"
133  - "Sender analysis"
134id: "9f39eea5-2edf-524d-b68b-d8d0bdb74273"