Brand impersonation: Social Security Administration

  1name: "Brand impersonation: Social Security Administration"
  2description: "Detects messages impersonating the Social Security Administration (SSA) through various indicators including display names, subjects, body content, attachments, and HTML titles. The rule identifies SSA references, confusable characters, statement notifications, and credential theft language while excluding legitimate government communications."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  // Identifies as SSA without catching strings such as "Alyssa"
  8  and (
  9    regex.contains(sender.display_name, '^SSA\b')
 10    or strings.icontains(sender.display_name, "Social Security Administration")
 11    // there are confusables in the display name
 12    or (
 13      strings.replace_confusables(sender.display_name) != sender.display_name
 14      and strings.contains(strings.replace_confusables(sender.display_name),
 15                           "SSA"
 16      )
 17    )
 18    or any([sender.display_name, subject.subject],
 19           regex.icontains(strings.replace_confusables(.),
 20                           'Social (?:benefits|security|s.a\b)',
 21           )
 22    )
 23    or (
 24      any(attachments,
 25          .file_type in ("doc", "docx")
 26          and any(file.explode(.),
 27                  strings.icontains(.scan.strings.raw,
 28                                    "Social Security Administration"
 29                  )
 30          )
 31      )
 32    )
 33    // display name or subject references a statement
 34    or (
 35      any([sender.display_name, subject.subject],
 36          regex.icontains(strings.replace_confusables(.),
 37                          '(Digital|(e[[:punct:]]?))\s?Statements?.{0,10}(Generated|Created|Issued|Ready)'
 38          )
 39      )
 40      // with SSA impersonation in the body
 41      and strings.icontains(body.current_thread.text,
 42                            'Social Security Administration'
 43      )
 44    )
 45    or any(html.xpath(body.html, '//title').nodes,
 46           (
 47             strings.icontains(.inner_text, 'Social Security')
 48             and (
 49               strings.icontains(.inner_text, 'Statement')
 50               or strings.icontains(.inner_text, 'Notification')
 51               or strings.icontains(.inner_text, 'Document')
 52               or strings.icontains(.inner_text, 'Message')
 53               or strings.icontains(.inner_text, 'Important Update')
 54               or strings.icontains(.inner_text, 'Benefit Amount')
 55               or strings.icontains(.inner_text, 'Account')
 56               or strings.icontains(.inner_text, 'Authorization')
 57             )
 58           )
 59           or .inner_text =~ "Social Security Administration"
 60           or .inner_text =~ "Social Security"
 61    )
 62    or (
 63      any(body.links,
 64          (
 65            strings.contains(.href_url.url, 'ssa.gov')
 66            or (.display_url.domain.root_domain == "ssa.gov" and .mismatched)
 67          )
 68      )
 69      and strings.icontains(body.current_thread.text,
 70                            'download monthly statement'
 71      )
 72      and strings.icontains(body.current_thread.text, 'stay connected')
 73    )
 74    or (
 75      any(ml.nlu_classifier(body.current_thread.text).entities,
 76          .name == "sender" and .text == "Social Security Administration"
 77      )
 78      and any(ml.nlu_classifier(body.current_thread.text).intents,
 79              .name == "cred_theft" and .confidence != "low"
 80      )
 81    )
 82  )
 83  
 84  // Not from a .gov domain
 85  and not (sender.email.domain.tld == "gov" and headers.auth_summary.dmarc.pass)
 86  
 87  // Additional suspicious indicator
 88  and (
 89    any(ml.nlu_classifier(body.current_thread.text).topics,
 90        .name in ("Security and Authentication", "Secure Message")
 91        and .confidence == "high"
 92    )
 93    or any(ml.nlu_classifier(body.current_thread.text).entities,
 94           .name == "org" and .text == "SSA"
 95    )
 96    or length(body.current_thread.text) == 0
 97    or body.current_thread.text is null
 98    or strings.icontains(body.current_thread.text, "SSA Statement Viewer")
 99    or strings.icontains(strings.replace_confusables(body.current_thread.text),
100                         "Social Security Statement"
101    )
102    or regex.icontains(body.current_thread.text,
103                       "(?:view|open) (?:your|the).{0,8} (statement|document)"
104    )
105    or regex.icontains(body.current_thread.text,
106                       "(?:view|open|assess|evaluate|review|conduct|read|scan)"
107    )
108    // real SSA phone number
109    or strings.icontains(body.current_thread.text, "1-800-772-1213")
110    or any(body.links,
111           any(regex.extract(.href_url.path, '\.(?P<ext>[^./?#]+)(?:[?#]|$)'),
112               .named_groups["ext"] in $file_extensions_executables
113           )
114    )
115    or any(ml.logo_detect(file.message_screenshot()).brands,
116           .name == "SSA" and .confidence == "high"
117    )
118    or (
119      any(attachments,
120          .file_type in ("doc", "docx")
121          and any(file.explode(.),
122                  strings.icontains(.scan.strings.raw, "suspended")
123                  or strings.icontains(.scan.strings.raw, "fraudulent")
124                  or strings.icontains(.scan.strings.raw, "violated")
125                  or strings.icontains(.scan.strings.raw, "false identity")
126                  or regex.icontains(.scan.strings.raw,
127                                     '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
128                                     '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
129                  )
130          )
131      )
132    )
133  )
134  and not (
135    any(ml.nlu_classifier(body.current_thread.text).topics,
136        .name in (
137          "Newsletters and Digests",
138          "Advertising and Promotions",
139          "Events and Webinars",
140          "Charity and Non-Profit",
141          "Political Mail"
142        )
143        and .confidence == "high"
144    )
145    or any(ml.nlu_classifier(body.current_thread.text).intents,
146           .name == "benign" and .confidence == "high"
147    )
148  )
149  and not (
150    sender.email.email in ("email@email.monarch.com", "contact@govplus.com")
151    and coalesce(headers.auth_summary.dmarc.pass, false)
152  )
153  
154  // not a forward or reply
155  and (headers.in_reply_to is null or length(headers.references) == 0)
156  and not (
157    sender.email.domain.root_domain in $high_trust_sender_root_domains
158    and coalesce(headers.auth_summary.dmarc.pass, false)
159  )  
160attack_types:
161  - "BEC/Fraud"
162  - "Credential Phishing"
163tactics_and_techniques:
164  - "Impersonation: Brand"
165  - "Social engineering"
166detection_methods:
167  - "Content analysis"
168  - "Sender analysis"
169  - "URL analysis"
170id: "6196767e-6264-5833-96f3-d1e34424d7b5"