Brand impersonation: Social Security Administration

  1name: "Brand impersonation: Social Security Administration"
  2description: "Detects messages impersonating the Social Security Administration (SSA) through various indicators including display names, subjects, body content, attachments, and HTML titles. The rule identifies SSA references, confusable characters, statement notifications, and credential theft language while excluding legitimate government communications."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  // Identifies as SSA without catching strings such as "Alyssa"
  8  and (
  9    regex.contains(sender.display_name, '^SSA\b')
 10    or strings.icontains(sender.display_name, "Social Security Administration")
 11    // there are confusables in the display name
 12    or (
 13      strings.replace_confusables(sender.display_name) != sender.display_name
 14      and strings.contains(strings.replace_confusables(sender.display_name),
 15                           "SSA"
 16      )
 17    )
 18    or any([sender.display_name, subject.subject],
 19           regex.icontains(strings.replace_confusables(.),
 20                           'Social (?:benefits|security|s.a\b)',
 21           )
 22    )
 23    or (
 24      strings.ilike(subject.base, "*statement*")
 25      and (
 26        strings.icontains(body.current_thread.text, "ssa.gov")
 27        or regex.icontains(body.current_thread.text,
 28                           '1[\s\-\.]?\(?\s*800\s*\)?[\s\-\.]?772[\s\-\.]?1213'
 29        )
 30      )
 31    )
 32    or (
 33      any(attachments,
 34          .file_type in ("doc", "docx")
 35          and any(file.explode(.),
 36                  strings.icontains(.scan.strings.raw,
 37                                    "Social Security Administration"
 38                  )
 39          )
 40      )
 41    )
 42    // display name or subject references a statement
 43    or (
 44      any([sender.display_name, subject.subject],
 45          regex.icontains(strings.replace_confusables(.),
 46                          '(Digital|(e[[:punct:]]?))\s?Statements?.{0,10}(Generated|Created|Issued|Ready)'
 47          )
 48      )
 49      // with SSA impersonation in the body
 50      and strings.icontains(body.current_thread.text,
 51                            'Social Security Administration'
 52      )
 53    )
 54    or any(html.xpath(body.html, '//title').nodes,
 55           (
 56             strings.icontains(.inner_text, 'Social Security')
 57             and (
 58               strings.icontains(.inner_text, 'Statement')
 59               or strings.icontains(.inner_text, 'Notification')
 60               or strings.icontains(.inner_text, 'Document')
 61               or strings.icontains(.inner_text, 'Message')
 62               or strings.icontains(.inner_text, 'Important Update')
 63               or strings.icontains(.inner_text, 'Benefit Amount')
 64               or strings.icontains(.inner_text, 'Account')
 65               or strings.icontains(.inner_text, 'Authorization')
 66             )
 67           )
 68           or .inner_text =~ "Social Security Administration"
 69           or .inner_text =~ "Social Security"
 70    )
 71    or (
 72      any(body.links,
 73          (
 74            strings.contains(.href_url.url, 'ssa.gov')
 75            or (.display_url.domain.root_domain == "ssa.gov" and .mismatched)
 76          )
 77      )
 78      and strings.icontains(body.current_thread.text,
 79                            'download monthly statement'
 80      )
 81      and strings.icontains(body.current_thread.text, 'stay connected')
 82    )
 83    or (
 84      any(ml.nlu_classifier(body.current_thread.text).entities,
 85          .name == "sender" and .text == "Social Security Administration"
 86      )
 87      and any(ml.nlu_classifier(body.current_thread.text).intents,
 88              .name == "cred_theft" and .confidence != "low"
 89      )
 90    )
 91  )
 92  
 93  // Not from a .gov domain
 94  and not (
 95    sender.email.domain.tld == "gov"
 96    and coalesce(headers.auth_summary.dmarc.pass, false)
 97  )
 98  
 99  // Additional suspicious indicator
100  and (
101    any(ml.nlu_classifier(body.current_thread.text).topics,
102        .name in ("Security and Authentication", "Secure Message")
103        and .confidence == "high"
104    )
105    or any(ml.nlu_classifier(body.current_thread.text).entities,
106           .name == "org" and .text == "SSA"
107    )
108    or length(body.current_thread.text) == 0
109    or body.current_thread.text is null
110    or strings.icontains(body.current_thread.text, "SSA Statement Viewer")
111    or strings.icontains(strings.replace_confusables(body.current_thread.text),
112                         "Social Security Statement"
113    )
114    or regex.icontains(body.current_thread.text,
115                       "(?:view|open) (?:your|the).{0,8} (statement|document)"
116    )
117    or regex.icontains(body.current_thread.text,
118                       "(?:view|open|assess|evaluate|review|conduct|read|scan)"
119    )
120    // real SSA phone number
121    or strings.icontains(body.current_thread.text, "1-800-772-1213")
122    or any(body.links,
123           any(regex.extract(.href_url.path, '\.(?P<ext>[^./?#]+)(?:[?#]|$)'),
124               .named_groups["ext"] in $file_extensions_executables
125           )
126    )
127    or any(ml.logo_detect(file.message_screenshot()).brands,
128           .name == "SSA" and .confidence == "high"
129    )
130    or (
131      any(attachments,
132          .file_type in ("doc", "docx")
133          and any(file.explode(.),
134                  strings.icontains(.scan.strings.raw, "suspended")
135                  or strings.icontains(.scan.strings.raw, "fraudulent")
136                  or strings.icontains(.scan.strings.raw, "violated")
137                  or strings.icontains(.scan.strings.raw, "false identity")
138                  or regex.icontains(.scan.strings.raw,
139                                     '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
140                                     '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
141                  )
142          )
143      )
144    )
145  )
146  and not (
147    any(ml.nlu_classifier(body.current_thread.text).topics,
148        .name in (
149          "Newsletters and Digests",
150          "Advertising and Promotions",
151          "Events and Webinars",
152          "Charity and Non-Profit",
153          "Political Mail"
154        )
155        and .confidence == "high"
156    )
157    or any(ml.nlu_classifier(body.current_thread.text).intents,
158           .name == "benign" and .confidence == "high"
159    )
160  )
161  and not (
162    sender.email.email in ("email@email.monarch.com", "contact@govplus.com")
163    and coalesce(headers.auth_summary.dmarc.pass, false)
164  )
165  
166  // not a forward or reply
167  and (headers.in_reply_to is null or length(headers.references) == 0)
168  and not (
169    sender.email.domain.root_domain in $high_trust_sender_root_domains
170    and coalesce(headers.auth_summary.dmarc.pass, false)
171  )
172    
173attack_types:
174  - "BEC/Fraud"
175  - "Credential Phishing"
176tactics_and_techniques:
177  - "Impersonation: Brand"
178  - "Social engineering"
179detection_methods:
180  - "Content analysis"
181  - "Sender analysis"
182  - "URL analysis"
183id: "6196767e-6264-5833-96f3-d1e34424d7b5"