Brand impersonation: PayPal
Impersonation of PayPal.
Sublime rule (View on GitHub)
1name: "Brand impersonation: PayPal"
2description: |
3 Impersonation of PayPal.
4references:
5 - "https://www.welivesecurity.com/2019/12/20/scam-wants-more-than-paypal-logins/"
6type: "rule"
7severity: "medium"
8source: |
9 type.inbound
10 and (
11 sender.display_name =~ "paypal"
12 or strings.ilevenshtein(sender.display_name, 'paypal') <= 1
13 or strings.ilike(sender.email.domain.domain, '*paypal*')
14 or any(attachments,
15 (.file_type in $file_types_images or .file_type == "pdf")
16 and any(ml.logo_detect(.).brands, .name == "PayPal")
17 and any(file.explode(.),
18 // exclude images taken with mobile cameras and screenshots from android
19 not any(.scan.exiftool.fields,
20 .key == "Model"
21 or (
22 .key == "Software"
23 and strings.starts_with(.value, "Android")
24 )
25 )
26 // exclude images taken with mobile cameras and screenshots from Apple
27 and not any(.scan.exiftool.fields,
28 .key == "DeviceManufacturer"
29 and .value == "Apple Computer Inc."
30 )
31 and strings.ilike(.scan.ocr.raw, "*PayPal*")
32 and strings.ilike(.scan.ocr.raw,
33 "*invoice*",
34 "*transaction*",
35 "*bitcoin*",
36 "*dear customer*",
37 )
38 )
39 )
40 )
41 and sender.email.domain.root_domain not in (
42 'paypal.com',
43 'paypal.ch',
44 'paypal.nl',
45 'paypal.co.uk',
46 'google.com',
47 'q4inc.com',
48 'paypal.com.au',
49 'paypal.com.mx',
50 'paypal.se',
51 'paypal.be',
52 'paypal.de',
53 'paypal.dk',
54 'paypal.pl',
55 'paypal.es',
56 'paypal.ca',
57 'paypal.fr',
58 'paypal.it',
59 'paypal.com.sg',
60 'synchronyfinancial.com',
61 'synchronybank.com',
62 'zettle.com',
63 'paypal-experience.com',
64 'paypalcorp.com',
65 'paypal-customerfeedback.com',
66 'paypal-creditsurvey.com',
67 'paypal-prepaid.com',
68 'xoom.com',
69 'paypal.co.il',
70 'paypal.co.br'
71 )
72 and (
73 not profile.by_sender().solicited
74 or (
75 profile.by_sender().any_messages_malicious_or_spam
76 and not profile.by_sender().any_false_positives
77 )
78 )
79
80 // negate highly trusted sender domains unless they fail DMARC authentication
81 and (
82 (
83 sender.email.domain.root_domain in $high_trust_sender_root_domains
84 and not headers.auth_summary.dmarc.pass
85 )
86 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
87 )
88
89attack_types:
90 - "Credential Phishing"
91tactics_and_techniques:
92 - "Impersonation: Brand"
93 - "Lookalike domain"
94 - "Social engineering"
95detection_methods:
96 - "Computer Vision"
97 - "Content analysis"
98 - "File analysis"
99 - "Header analysis"
100 - "Sender analysis"
101id: "a6b2ceee-ea57-594d-8437-698fad55c9bf"