Brand impersonation: Netflix

  1name: "Brand impersonation: Netflix"
  2description: |
  3    Impersonation of Netflix.
  4references:
  5  - "https://news.trendmicro.com/2023/01/18/netflix-scams-2023-job-text-email/"
  6type: "rule"
  7severity: "low"
  8authors:
  9  - name: "min0k"
 10source: |
 11  type.inbound
 12  and (
 13    // obfuscated sender display name
 14    (
 15      sender.display_name is not null
 16      and (
 17        regex.icontains(strings.replace_confusables(sender.display_name),
 18                        '[nm]etf[li][il]x'
 19        )
 20        or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
 21                                'netflix'
 22        ) <= 1
 23        or regex.icontains(strings.replace_confusables(sender.display_name),
 24                           'n.{0,3}e.{0,3}t.{0,3}f.{0,3}l.{0,3}i.{0,3}x.{0,3}'
 25        )
 26      )
 27    )
 28    // Netflix reactivate subscription 
 29    or (
 30      strings.icontains(subject.base, "netflix")
 31      and regex.icontains(body.current_thread.text,
 32                          'reactivate\s+(your\s+)?subscription'
 33      )
 34    )
 35    // obfuscated sender email domain
 36    or regex.icontains(strings.replace_confusables(sender.email.domain.domain),
 37                       '[nm]etf[li][il]x'
 38    )
 39    // logo detection on message screenshot (no link analysis)
 40    or (
 41      any(ml.logo_detect(file.message_screenshot()).brands,
 42          .name == "Netflix" and .confidence in ("medium", "high")
 43      )
 44      and (
 45        // non NLU based keywords on the screenshot
 46        regex.icontains(beta.ocr(file.message_screenshot()).text,
 47                        'suspen(?:ded|sion)'
 48        )
 49        or 
 50        // combo of NLU cred_theft + financial + Customer Service and Support
 51        (
 52          any(ml.nlu_classifier(body.current_thread.text).intents,
 53              .name == "cred_theft"
 54          )
 55          and any(ml.nlu_classifier(body.current_thread.text).entities,
 56                  .name == "financial"
 57          )
 58          and any(ml.nlu_classifier(body.current_thread.text).topics,
 59                  .name == "Customer Service and Support"
 60          )
 61        )
 62      )
 63    )
 64    // Address Detection
 65    or 2 of (
 66      strings.icontains(body.current_thread.text, 'Netflix, Inc'),
 67      strings.icontains(body.current_thread.text, '100 Winchester Circle'),
 68      strings.icontains(body.current_thread.text, 'Los Gatos, CA 95032')
 69    )
 70    // unusual recipient pattern + logo detect + credphish dispoistion
 71    or (
 72      (
 73        length(recipients.to) == 0
 74        or (
 75          all(recipients.to, .email.domain.valid == false)
 76          and all(recipients.cc, .email.domain.valid == false)
 77        )
 78      )
 79      and any(ml.logo_detect(file.message_screenshot()).brands,
 80              .name == "Netflix" and .confidence in ("medium", "high")
 81      )
 82      and (
 83        any(body.links,
 84            ml.link_analysis(.).credphish.disposition == "phishing"
 85            and ml.link_analysis(.).credphish.confidence in ("medium", "high")
 86        )
 87      )
 88    )
 89  )
 90  // negation of legit domains
 91  and not (
 92    sender.email.domain.root_domain in (
 93      'netflix.com',
 94      'dvd.com',
 95      'netflixfamily.com',
 96      'netflixpreviewclub.com',
 97      'netflixanimation.com',
 98      'envoy.com',
 99      'lexisnexis.com',
100      'netflix.shop',
101      'netflixcontractors.com', // owned by netflix
102      'netflixevents.com', // owned by netflix
103      'netelixir.com', // unrelated marketing
104      'netflixhouse.com', // owned by netflix
105      'instagram.com',
106      'netflix.net',
107      'netflixshopsupport.com', // owned by netflix
108      'netflixpartner.com', // owned by netflix
109    )
110    and coalesce(headers.auth_summary.dmarc.pass, false)
111  )
112  and not (
113    sender.email.domain.domain in (
114      'netflix.zendesk.com' // netflix actual support
115    )
116    and coalesce(headers.auth_summary.dmarc.pass, false)
117  )
118  and not profile.by_sender_email().solicited  
119attack_types:
120  - "Credential Phishing"
121tactics_and_techniques:
122  - "Impersonation: Brand"
123  - "Lookalike domain"
124  - "Social engineering"
125detection_methods:
126  - "Header analysis"
127  - "Sender analysis"
128id: "9f39eea5-2edf-524d-b68b-d8d0bdb74273"