Brand impersonation: Outlook

 1name: "Brand impersonation: Outlook"
 2description: |
 3  Impersonation of Outlook.com. Senders with "outlook.com" in the subdomain
 4  have been observed sending fake account notifications.  
 5type: "rule"
 6severity: "high"
 7source: |
 8  type.inbound
 9  and regex.icontains(sender.email.domain.domain, '.*outlook.com.+')
10  // Negate legitimate outlook root domains
11  and not (
12    sender.email.domain.root_domain in (
13      'outlook.com.au',
14      'outlook.com.br',
15      'outlook.com.ar',
16      'outlook.at',
17      'outlook.be',
18      'outlook.cl',
19      'outlook.cz',
20      'outlook.dk',
21      'outlook.fr',
22      'outlook.de',
23      'outlook.com.gr',
24      'outlook.co.il',
25      'outlook.in',
26      'outlook.co.id',
27      'outlook.ie',
28      'outlook.it',
29      'outlook.hu',
30      'outlook.jp',
31      'outlook.kr',
32      'outlook.lv',
33      'outlook.my',
34      'outlook.co.nz',
35      'outlook.com.pe',
36      'outlook.ph',
37      'outlook.pt',
38      'outlook.sa',
39      'outlook.sg',
40      'outlook.sk',
41      'outlook.es',
42      'outlook.co.th',
43      'outlook.com.tr',
44      'outlook.com.vn'
45    )
46    and coalesce(headers.auth_summary.dmarc.pass, false)
47  )
48  and sender.email.email not in $recipient_emails  
49attack_types:
50  - "Credential Phishing"
51tactics_and_techniques:
52  - "Impersonation: Brand"
53  - "Lookalike domain"
54  - "Social engineering"
55detection_methods:
56  - "Header analysis"
57  - "Sender analysis"
58id: "1fe5bf7b-c4e8-5f8e-a2d7-07e32bd9678f"