Impersonation: SAM/SBA federal registration

 1name: "Impersonation: SAM/SBA federal registration"
 2description: "Detects inbound messages impersonating SAM.gov or the Small Business Administration by matching sender display names against known spoofed naming patterns (e.g. sba-support, sam registration/renewal) or by identifying sam.gov references paired with an embedded 'renew entity' image lure. Legitimate senders from verified sba.gov, sam.gov, or other high-trust domains that pass DMARC authentication are excluded."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and (
 8    regex.icontains(sender.display_name,
 9                    '^sam(?:\.gov\b|\s(?:renew|compliance))',
10                    'final\ssam\.gov',
11                    '^sba[\s-]?(?:e[fd]|[\.,]gov)',
12                    '^sba[\s-](?:connect|invoice|admin|eidl|profile)\b',
13                    '^sba[\s-]support[\s-]\w+'
14    )
15    or (
16      strings.icontains(body.current_thread.text,
17                        'sam.gov',
18                        'system for award management'
19      )
20      and (
21        any(html.xpath(body.html, '//img/@src').nodes,
22            strings.icontains(.raw, 'sam%20renew%20entity')
23            or regex.icontains(.raw, '[./]sam[a-z]{3,}\.com')
24        )
25        or regex.icontains(subject.base,
26                           'cage\s+code\s+[a-z0-9]{5}',
27                           'sam\s(?:renew|status)'
28        )
29      )
30    )
31  )
32  and not (
33    sender.email.domain.root_domain in $high_trust_sender_root_domains
34    and coalesce(headers.auth_summary.dmarc.pass, false)
35  )  
36attack_types:
37  - "Credential Phishing"
38  - "BEC/Fraud"
39tactics_and_techniques:
40  - "Impersonation: Brand"
41  - "Social engineering"
42  - "Image as content"
43detection_methods:
44  - "Sender analysis"
45  - "Content analysis"
46  - "HTML analysis"
47  - "Header analysis"
48id: "057ad471-4564-584c-a700-bba6e0c6eea9"