Impersonation: Suspected supplier impersonation with suspicious content

 1name: "Impersonation: Suspected supplier impersonation with suspicious content"
 2description: "This rule detects supplier impersonation by checking for: similar linked domains to the sender, non-freemail senders using freemail infrastructure, sender domains less than 90 days old, unsolicited communication or no prior interaction with the reply-to address, and a suspicious body."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  
 8  // a linked domain is similar but not the same as the sender domain
 9  and (
10    any(body.links,
11        length(.href_url.domain.sld) > 3
12        and 0 < strings.levenshtein(.href_url.domain.sld, sender.email.domain.sld) <= 2
13  
14        // looking for lookalike domains above, typically the registrars won't match
15        and network.whois(sender.email.domain).registrar_name != network.whois(.href_url.domain
16        ).registrar_name
17  
18        // and one of the domains is less than 30 days old
19        and (
20          network.whois(sender.email.domain).days_old < 30
21          or network.whois(.href_url.domain).days_old < 30
22        )
23    )
24    and not sender.email.domain.root_domain == "onmicrosoft.com"
25  )
26  // the sender is not a freemail, but the message or the in-reply-to indicates it traversed a freemail infrastructure, likely an auto forwarding rule. Or the sender or reply-to domain is new
27  and (
28    sender.email.domain.root_domain not in $free_email_providers
29    and (
30      any(headers.references,
31          any($free_email_providers, strings.contains(.., .))
32          and not strings.ends_with(., "outlook.com")
33      )
34      or (
35        any($free_email_providers, strings.contains(headers.in_reply_to, .))
36        // with the suspicious traversal tolerate 90 days
37        and network.whois(sender.email.domain).days_old < 90
38        and not strings.ends_with(headers.in_reply_to, 'outlook.com')
39      )
40      or any(headers.reply_to,
41             network.whois(.email.domain).days_old < 30
42             and .email.email != sender.email.email
43      )
44    )
45  )
46  
47  //  not solicited, nor ever communicated with
48  and (
49    not profile.by_sender_domain().solicited
50    // reply-to is not in $recipient_emails
51    or any(headers.reply_to, .email.email not in $recipient_emails)
52  )
53  and (
54    2 of (
55      // language attempting to engage
56      (
57        any(ml.nlu_classifier(coalesce(body.plain.raw, body.current_thread.text)).entities,
58            .name == "request"
59        )
60        and any(ml.nlu_classifier(coalesce(body.plain.raw,
61                                           body.current_thread.text
62                                  )
63                ).entities,
64                .name == "financial"
65        )
66      ),
67      // payment tag high confidence
68      any(ml.nlu_classifier(coalesce(body.plain.raw, body.current_thread.text)).tags,
69          .name == "payment" and .confidence == "high"
70      ),
71      // invoicing language
72      any(ml.nlu_classifier(coalesce(body.plain.raw, body.current_thread.text)).tags,
73          .name == "invoice"
74      ),
75  
76      // urgency request
77      any(ml.nlu_classifier(coalesce(body.plain.raw, body.current_thread.text)).entities,
78          .name == "urgency"
79      )
80    )
81  )  
82attack_types:
83  - "BEC/Fraud"
84tactics_and_techniques:
85  - "Evasion"
86  - "Free email provider"
87  - "Lookalike domain"
88  - "Social engineering"
89detection_methods:
90  - "Content analysis"
91  - "Header analysis"
92  - "Natural Language Understanding"
93  - "Sender analysis"
94  - "URL analysis"
95  - "Whois"
96id: "63d8b1ce-7409-58d9-aa78-fffba12bba29"