Impersonation: Securities and Exchange Commission (SEC)

 1name: "Impersonation: Securities and Exchange Commission (SEC)"
 2description: "Detects inbound messages impersonating the U.S. Securities and Exchange Commission (SEC) through sender display names, body content, or NLU-detected sender entities referencing the SEC or sec.gov. Also flags messages containing SEC-related language paired with links to lookalike domains mimicking sec.gov. Excludes messages from highly trusted sender domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    regex.icontains(sender.display_name,
 9                    '^sec\.gov\b',
10                    'sec\.gov[\s.]*client',
11                    '^sec[\s-]?(?:gov|compliance|enforcement|division)\b',
12                    'securities\s+and\s+exchange\s+commission'
13    )
14    or any(ml.nlu_classifier(body.current_thread.text).entities,
15           .name == "sender"
16           and strings.icontains(.text, 'securities and exchange commission')
17    )
18    or (
19      (
20        strings.icontains(body.current_thread.text, 'u.s. securities')
21        or strings.icontains(sender.display_name, 'sec.gov')
22      )
23      and any(body.links,
24              (
25                regex.icontains(.href_url.domain.domain, 'sec\.?gov')
26                and .href_url.domain.root_domain != "sec.gov"
27              )
28              or regex.icontains(.href_url.domain.subdomain, 'w{2,3}\.?secgov')
29      )
30    )
31  )
32  and not any(ml.nlu_classifier(body.current_thread.text).topics,
33              .name in ("Newsletters and Digests", "News and Current Events")
34  )
35  and not (
36    (
37      sender.email.domain.root_domain in $high_trust_sender_root_domains
38      or sender.email.domain.root_domain in ("govdelivery.com")
39    )
40    and coalesce(headers.auth_summary.dmarc.pass, false)
41  )  
42attack_types:
43  - "BEC/Fraud"
44  - "Credential Phishing"
45tactics_and_techniques:
46  - "Impersonation: Brand"
47  - "Spoofing"
48  - "Lookalike domain"
49  - "Social engineering"
50detection_methods:
51  - "Sender analysis"
52  - "Content analysis"
53  - "URL analysis"
54  - "Natural Language Understanding"
55  - "Header analysis"
56id: "30d812fa-4e54-519d-ad9d-86e060ed2192"