Brand Impersonation: PayPal
Impersonation of PayPal.
Sublime rule (View on GitHub)
1name: "Brand Impersonation: PayPal"
2description: |
3 Impersonation of PayPal.
4references:
5 - "https://www.welivesecurity.com/2019/12/20/scam-wants-more-than-paypal-logins/"
6type: "rule"
7severity: "medium"
8source: |
9 type.inbound
10 and (
11 strings.replace_confusables(sender.display_name) =~ "paypal"
12 or strings.ilevenshtein(strings.replace_confusables(sender.display_name), 'paypal') <= 1
13 or strings.ilike(strings.replace_confusables(sender.display_name), '*paypal*')
14 or any(attachments,
15 (.file_type in $file_types_images or .file_type == "pdf")
16 and any(ml.logo_detect(.).brands, .name == "PayPal")
17 and any(file.explode(.),
18 // exclude images taken with mobile cameras and screenshots from android
19 not any(.scan.exiftool.fields,
20 .key == "Model"
21 or (
22 .key == "Software"
23 and strings.starts_with(.value, "Android")
24 )
25 )
26 // exclude images taken with mobile cameras and screenshots from Apple
27 and not any(.scan.exiftool.fields,
28 .key == "DeviceManufacturer"
29 and .value == "Apple Computer Inc."
30 )
31 and strings.ilike(.scan.ocr.raw, "*PayPal*")
32 and strings.ilike(.scan.ocr.raw,
33 "*invoice*",
34 "*transaction*",
35 "*bitcoin*",
36 "*dear customer*",
37 "*suspicious activity*"
38 )
39 )
40 )
41 or (
42 any(ml.logo_detect(beta.message_screenshot()).brands, .name == "PayPal")
43 and strings.ilike(body.current_thread.text, "*PayPal*")
44 and strings.ilike(body.current_thread.text,
45 "*invoice*",
46 "*transaction*",
47 "*bitcoin*",
48 "*dear customer*",
49 "*suspicious activity*"
50 )
51 )
52 )
53 and sender.email.domain.root_domain not in (
54 'google.com',
55 'paypal-creditsurvey.com',
56 'paypal-customerfeedback.com',
57 'paypal-experience.com',
58 'paypal-prepaid.com',
59 'paypal.at',
60 'paypal.be',
61 'paypal.ca',
62 'paypal.ch',
63 'paypal.co.br',
64 'paypal.co.il',
65 'paypal.co.uk',
66 'paypal.com',
67 'paypal.com.au',
68 'paypal.com.mx',
69 'paypal.com.sg',
70 'paypal.de',
71 'paypal.dk',
72 'paypal.es',
73 'paypal.fr',
74 'paypal.hk',
75 'paypal.it',
76 'paypal.nl',
77 'paypal.pl',
78 'paypal.se',
79 'paypalcorp.com',
80 'q4inc.com',
81 'synchronybank.com',
82 'synchronyfinancial.com',
83 'xoom.com',
84 'zettle.com'
85 )
86 and (
87 not profile.by_sender().solicited
88 or (
89 profile.by_sender().any_messages_malicious_or_spam
90 and not profile.by_sender().any_false_positives
91 )
92 )
93
94 // negate highly trusted sender domains unless they fail DMARC authentication
95 and (
96 (
97 sender.email.domain.root_domain in $high_trust_sender_root_domains
98 and not headers.auth_summary.dmarc.pass
99 )
100 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
101 )
102
103attack_types:
104 - "Credential Phishing"
105tactics_and_techniques:
106 - "Impersonation: Brand"
107 - "Lookalike domain"
108 - "Social engineering"
109detection_methods:
110 - "Computer Vision"
111 - "Content analysis"
112 - "File analysis"
113 - "Header analysis"
114 - "Sender analysis"
115id: "a6b2ceee-ea57-594d-8437-698fad55c9bf"