Brand Impersonation: PayPal

  1name: "Brand Impersonation: PayPal"
  2description: |
  3    Impersonation of PayPal.
  4references:
  5  - "https://www.welivesecurity.com/2019/12/20/scam-wants-more-than-paypal-logins/"
  6type: "rule"
  7severity: "medium"
  8source: |
  9  type.inbound
 10  and (
 11    strings.replace_confusables(sender.display_name) =~ "paypal"
 12    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
 13                            'paypal'
 14    ) <= 1
 15    or strings.ilike(strings.replace_confusables(sender.display_name), '*paypal*')
 16    or strings.icontains(body.current_thread.text, "paypal billing team")
 17    or strings.icontains(body.current_thread.text, "paypal account services")
 18    or any(attachments,
 19           (.file_type in $file_types_images or .file_type == "pdf")
 20           and any(ml.logo_detect(.).brands, .name == "PayPal")
 21           and any(file.explode(.),
 22                   // exclude images taken with mobile cameras and screenshots from android
 23                   not any(.scan.exiftool.fields,
 24                           .key == "Model"
 25                           or (
 26                             .key == "Software"
 27                             and strings.starts_with(.value, "Android")
 28                           )
 29                   )
 30                   // exclude images taken with mobile cameras and screenshots from Apple
 31                   and not any(.scan.exiftool.fields,
 32                               .key == "DeviceManufacturer"
 33                               and .value == "Apple Computer Inc."
 34                   )
 35                   and strings.ilike(.scan.ocr.raw, "*PayPal*")
 36                   and strings.ilike(.scan.ocr.raw,
 37                                     "*invoice*",
 38                                     "*transaction*",
 39                                     "*bitcoin*",
 40                                     "*dear customer*",
 41                                     "*suspicious activity*"
 42                   )
 43           )
 44    )
 45    or (
 46      any(ml.logo_detect(file.message_screenshot()).brands, .name == "PayPal")
 47      and strings.ilike(body.current_thread.text, "*PayPal*")
 48      and strings.ilike(body.current_thread.text,
 49                        "*invoice*",
 50                        "*transaction*",
 51                        "*bitcoin*",
 52                        "*dear customer*",
 53                        "*suspicious activity*"
 54      )
 55    )
 56  )
 57  and not any(ml.nlu_classifier(body.current_thread.text).topics,
 58              .name in~ (
 59                "Professional and Career Development",
 60                "Government Services"
 61              )
 62  )
 63  and sender.email.domain.root_domain not in (
 64    'google.com',
 65    'paypal-brandsfeedback.com',
 66    'paypal-creditsurvey.com',
 67    'paypal-customerfeedback.com',
 68    'paypal-experience.com',
 69    'paypal-prepaid.com',
 70    'paypal.at',
 71    'paypal.be',
 72    'paypal.ca',
 73    'paypal.ch',
 74    'paypal.co.il',
 75    'paypal.co.uk',
 76    'paypal.com',
 77    'paypal.com.au',
 78    'paypal.com.mx',
 79    'paypal.com.sg',
 80    'paypal.de',
 81    'paypal.dk',
 82    'paypal.es',
 83    'paypal.fr',
 84    'paypal.hk',
 85    'paypal.it',
 86    'paypal.nl',
 87    'paypal.pl',
 88    'paypal.se',
 89    'paypalcorp.com',
 90    'q4inc.com',
 91    'synchrony.com',
 92    'synchronybank.com',
 93    'synchronyfinancial.com',
 94    'xoom.com',
 95    'zettle.com'
 96  )
 97  // negate paypal.co.br explicitly, this cannot be part of the root_domain set above as it uses the PSL (Public suffix list) for parsing and co.br is not a recognized public suffix.
 98  and sender.email.domain.domain not in~ ('paypal.co.br')
 99  and (
100    not profile.by_sender().solicited
101    or (
102      profile.by_sender().any_messages_malicious_or_spam
103      and not profile.by_sender().any_messages_benign
104    )
105  )
106  
107  // negate highly trusted sender domains unless they fail DMARC authentication
108  and (
109    (
110      sender.email.domain.root_domain in $high_trust_sender_root_domains
111      and not headers.auth_summary.dmarc.pass
112    )
113    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
114  )  
115attack_types:
116  - "Credential Phishing"
117tactics_and_techniques:
118  - "Impersonation: Brand"
119  - "Lookalike domain"
120  - "Social engineering"
121detection_methods:
122  - "Computer Vision"
123  - "Content analysis"
124  - "File analysis"
125  - "Header analysis"
126  - "Sender analysis"
127id: "a6b2ceee-ea57-594d-8437-698fad55c9bf"