Brand impersonation: Netflix

  1name: "Brand impersonation: Netflix"
  2description: |
  3    Impersonation of Netflix.
  4references:
  5  - "https://news.trendmicro.com/2023/01/18/netflix-scams-2023-job-text-email/"
  6type: "rule"
  7severity: "low"
  8authors:
  9  - name: "min0k"
 10source: |
 11  type.inbound
 12  and (
 13    // obfuscated sender display name
 14    (
 15      sender.display_name is not null
 16      and (
 17        regex.icontains(strings.replace_confusables(sender.display_name),
 18                        '[nm]etf[li][il]x'
 19        )
 20        or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
 21                                'netflix'
 22        ) <= 1
 23        or regex.icontains(strings.replace_confusables(sender.display_name),
 24                           'n.{0,3}e.{0,3}t.{0,3}f.{0,3}l.{0,3}i.{0,3}x.{0,3}'
 25        )
 26      )
 27    )
 28    // Netflix reactivate subscription
 29    or (
 30      strings.icontains(subject.base, "netflix")
 31      and regex.icontains(body.current_thread.text,
 32                          'reactivate\s+(your\s+)?subscription'
 33      )
 34    )
 35    or (
 36      strings.icontains(strings.replace_confusables(body.current_thread.text),
 37                        'netplusflix'
 38      )
 39      and strings.count(body.current_thread.text, '©') == 1
 40    )
 41    // obfuscated sender email domain
 42    or regex.icontains(strings.replace_confusables(sender.email.domain.domain),
 43                       '[nm]etf[li][il]x'
 44    )
 45    or (
 46      strings.istarts_with(body.current_thread.text, "netflix")
 47      and any(ml.nlu_classifier(body.current_thread.text).intents,
 48              .name == "cred_theft" and .confidence != "low"
 49      )
 50    )
 51    // logo detection on message screenshot (no link analysis)
 52    or (
 53      any(ml.logo_detect(file.message_screenshot()).brands,
 54          .name == "Netflix" and .confidence in ("medium", "high")
 55      )
 56      and (
 57        // non NLU based keywords on the screenshot
 58        regex.icontains(beta.ocr(file.message_screenshot()).text,
 59                        'suspen(?:ded|sion)'
 60        )
 61        or 
 62        // combo of NLU cred_theft + financial + Customer Service and Support
 63        (
 64          any(ml.nlu_classifier(body.current_thread.text).intents,
 65              .name == "cred_theft"
 66          )
 67          and any(ml.nlu_classifier(body.current_thread.text).entities,
 68                  .name == "financial"
 69          )
 70          and any(ml.nlu_classifier(body.current_thread.text).topics,
 71                  .name == "Customer Service and Support"
 72          )
 73        )
 74      )
 75    )
 76    // Address Detection
 77    or 2 of (
 78      strings.icontains(body.current_thread.text, 'Netflix, Inc'),
 79      strings.icontains(body.current_thread.text, '100 Winchester Circle'),
 80      strings.icontains(body.current_thread.text, 'Los Gatos, CA 95032')
 81    )
 82    // unusual recipient pattern + logo detect + credphish dispoistion
 83    or (
 84      (
 85        length(recipients.to) == 0
 86        or (
 87          all(recipients.to, .email.domain.valid == false)
 88          and all(recipients.cc, .email.domain.valid == false)
 89        )
 90      )
 91      and any(ml.logo_detect(file.message_screenshot()).brands,
 92              .name == "Netflix" and .confidence in ("medium", "high")
 93      )
 94      and (
 95        any(body.links,
 96            ml.link_analysis(.).credphish.disposition == "phishing"
 97            and ml.link_analysis(.).credphish.confidence in ("medium", "high")
 98        )
 99      )
100    )
101  )
102  // negation of legit domains
103  and not (
104    sender.email.domain.root_domain in (
105      'netflix.com',
106      'dvd.com',
107      'netflixfamily.com',
108      'netflixpreviewclub.com',
109      'netflixanimation.com',
110      'envoy.com',
111      'lexisnexis.com',
112      'netflix.shop',
113      'netflixcontractors.com', // owned by netflix
114      'netflixevents.com', // owned by netflix
115      'netelixir.com', // unrelated marketing
116      'netflixhouse.com', // owned by netflix
117      'instagram.com',
118      'netflix.net',
119      'netflixshopsupport.com', // owned by netflix
120      'netflixpartner.com', // owned by netflix
121    )
122    and coalesce(headers.auth_summary.dmarc.pass, false)
123  )
124  and not (
125    sender.email.domain.domain in (
126      'netflix.zendesk.com' // netflix actual support
127    )
128    and coalesce(headers.auth_summary.dmarc.pass, false)
129  )
130  and not profile.by_sender_email().solicited  
131attack_types:
132  - "Credential Phishing"
133tactics_and_techniques:
134  - "Impersonation: Brand"
135  - "Lookalike domain"
136  - "Social engineering"
137detection_methods:
138  - "Header analysis"
139  - "Sender analysis"
140id: "9f39eea5-2edf-524d-b68b-d8d0bdb74273"