Brand impersonation: Social Security Administration

  1name: "Brand impersonation: Social Security Administration"
  2description: "Detects messages impersonating the Social Security Administration (SSA) through various indicators including display names, subjects, body content, attachments, and HTML titles. The rule identifies SSA references, confusable characters, statement notifications, and credential theft language while excluding legitimate government communications."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  // Identifies as SSA without catching strings such as "Alyssa"
  8  and (
  9    regex.contains(sender.display_name, '^SSA\b')
 10    or strings.icontains(sender.display_name, "Social Security Administration")
 11    // there are confusables in the display name
 12    or (
 13      strings.replace_confusables(sender.display_name) != sender.display_name
 14      and strings.contains(strings.replace_confusables(sender.display_name),
 15                           "SSA"
 16      )
 17    )
 18    or any([sender.display_name, subject.subject],
 19           regex.icontains(strings.replace_confusables(.),
 20                           'Social (?:benefits|security|s.a\b)',
 21           )
 22    )
 23    or (
 24      strings.ilike(subject.base, "*statement*")
 25      and (
 26        strings.icontains(body.current_thread.text, "ssa.gov")
 27        or regex.icontains(body.current_thread.text,
 28                           '1[\s\-\.]?\(?\s*800\s*\)?[\s\-\.]?772[\s\-\.]?1213'
 29        )
 30      )
 31    )
 32    or (
 33      any(attachments,
 34          .file_type in ("doc", "docx")
 35          and any(file.explode(.),
 36                  strings.icontains(.scan.strings.raw,
 37                                    "Social Security Administration"
 38                  )
 39          )
 40      )
 41    )
 42    // display name or subject references a statement
 43    or (
 44      any([sender.display_name, subject.subject],
 45          regex.icontains(strings.replace_confusables(.),
 46                          '(Digital|(e[[:punct:]]?))\s?Statements?.{0,10}(Generated|Created|Issued|Ready)'
 47          )
 48      )
 49      // with SSA impersonation in the body
 50      and strings.icontains(body.current_thread.text,
 51                            'Social Security Administration'
 52      )
 53    )
 54    or any(html.xpath(body.html, '//title').nodes,
 55           (
 56             strings.icontains(.inner_text, 'Social Security')
 57             and (
 58               strings.icontains(.inner_text, 'Statement')
 59               or strings.icontains(.inner_text, 'Notification')
 60               or strings.icontains(.inner_text, 'Document')
 61               or strings.icontains(.inner_text, 'Message')
 62               or strings.icontains(.inner_text, 'Important Update')
 63               or strings.icontains(.inner_text, 'Benefit Amount')
 64               or strings.icontains(.inner_text, 'Account')
 65               or strings.icontains(.inner_text, 'Authorization')
 66             )
 67           )
 68           or .inner_text =~ "Social Security Administration"
 69           or .inner_text =~ "Social Security"
 70    )
 71    or (
 72      any(body.links,
 73          (
 74            strings.contains(.href_url.url, 'ssa.gov')
 75            or (.display_url.domain.root_domain == "ssa.gov" and .mismatched)
 76          )
 77      )
 78      and strings.icontains(body.current_thread.text,
 79                            'download monthly statement'
 80      )
 81      and strings.icontains(body.current_thread.text, 'stay connected')
 82    )
 83    or (
 84      any(ml.nlu_classifier(body.current_thread.text).entities,
 85          .name == "sender" and .text == "Social Security Administration"
 86      )
 87      and any(ml.nlu_classifier(body.current_thread.text).intents,
 88              .name == "cred_theft" and .confidence != "low"
 89      )
 90    )
 91  )
 92  
 93  // Not from a .gov domain
 94  and not (sender.email.domain.tld == "gov" and headers.auth_summary.dmarc.pass)
 95  
 96  // Additional suspicious indicator
 97  and (
 98    any(ml.nlu_classifier(body.current_thread.text).topics,
 99        .name in ("Security and Authentication", "Secure Message")
100        and .confidence == "high"
101    )
102    or any(ml.nlu_classifier(body.current_thread.text).entities,
103           .name == "org" and .text == "SSA"
104    )
105    or length(body.current_thread.text) == 0
106    or body.current_thread.text is null
107    or strings.icontains(body.current_thread.text, "SSA Statement Viewer")
108    or strings.icontains(strings.replace_confusables(body.current_thread.text),
109                         "Social Security Statement"
110    )
111    or regex.icontains(body.current_thread.text,
112                       "(?:view|open) (?:your|the).{0,8} (statement|document)"
113    )
114    or regex.icontains(body.current_thread.text,
115                       "(?:view|open|assess|evaluate|review|conduct|read|scan)"
116    )
117    // real SSA phone number
118    or strings.icontains(body.current_thread.text, "1-800-772-1213")
119    or any(body.links,
120           any(regex.extract(.href_url.path, '\.(?P<ext>[^./?#]+)(?:[?#]|$)'),
121               .named_groups["ext"] in $file_extensions_executables
122           )
123    )
124    or any(ml.logo_detect(file.message_screenshot()).brands,
125           .name == "SSA" and .confidence == "high"
126    )
127    or (
128      any(attachments,
129          .file_type in ("doc", "docx")
130          and any(file.explode(.),
131                  strings.icontains(.scan.strings.raw, "suspended")
132                  or strings.icontains(.scan.strings.raw, "fraudulent")
133                  or strings.icontains(.scan.strings.raw, "violated")
134                  or strings.icontains(.scan.strings.raw, "false identity")
135                  or regex.icontains(.scan.strings.raw,
136                                     '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
137                                     '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
138                  )
139          )
140      )
141    )
142  )
143  and not (
144    any(ml.nlu_classifier(body.current_thread.text).topics,
145        .name in (
146          "Newsletters and Digests",
147          "Advertising and Promotions",
148          "Events and Webinars",
149          "Charity and Non-Profit",
150          "Political Mail"
151        )
152        and .confidence == "high"
153    )
154    or any(ml.nlu_classifier(body.current_thread.text).intents,
155           .name == "benign" and .confidence == "high"
156    )
157  )
158  and not (
159    sender.email.email in ("email@email.monarch.com", "contact@govplus.com")
160    and coalesce(headers.auth_summary.dmarc.pass, false)
161  )
162  
163  // not a forward or reply
164  and (headers.in_reply_to is null or length(headers.references) == 0)
165  and not (
166    sender.email.domain.root_domain in $high_trust_sender_root_domains
167    and coalesce(headers.auth_summary.dmarc.pass, false)
168  )
169    
170attack_types:
171  - "BEC/Fraud"
172  - "Credential Phishing"
173tactics_and_techniques:
174  - "Impersonation: Brand"
175  - "Social engineering"
176detection_methods:
177  - "Content analysis"
178  - "Sender analysis"
179  - "URL analysis"
180id: "6196767e-6264-5833-96f3-d1e34424d7b5"