Brand impersonation: USPS

  1name: "Brand impersonation: USPS"
  2description: "Impersonation of the United States Postal Service."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and (
  8    any(ml.logo_detect(file.message_screenshot()).brands, .name == "USPS")
  9    or strings.icontains(sender.display_name, "USPS")
 10    or strings.icontains(sender.display_name, "United States Postal Service")
 11    or regex.contains(body.html.display_text, 'USPS\s*\.\s*COM')
 12    or strings.icontains(body.current_thread.text, 'USPS Delivery Team')
 13    or any(ml.nlu_classifier(body.current_thread.text).entities,
 14           .name == "org" and .text =~ "USPS"
 15    )
 16  )
 17  and length(body.links) > 0
 18  and 3 of (
 19    any(body.links,
 20        strings.ilike(.display_text,
 21                      "*check now*",
 22                      "*track*",
 23                      "*package*",
 24                      '*view your order*',
 25                      "*update*",
 26                      '*delivery address*',
 27                      "*parcel allocation*",
 28                      "*claim your parcel*",
 29                      "*delivery details*",
 30                      "start*survey"
 31        )
 32    ),
 33    strings.ilike(body.current_thread.text,
 34                  "*returned*to*sender*",
 35                  "*redelivery*",
 36                  '*USPS promotions*',
 37                  '*review your package*',
 38                  '*receiver address*',
 39                  '*package details*',
 40                  '*sorry tolet*',
 41                  '*Due to an incorrect*',
 42                  '*remain undeliverable*',
 43                  "*service updates*",
 44                  "*exclusive survey reward*"
 45    ),
 46    // impersonal greeting
 47    any(ml.nlu_classifier(body.current_thread.text).entities,
 48        .name == "recipient" and .text =~ "Customer"
 49    ),
 50    any(ml.nlu_classifier(body.current_thread.text).intents,
 51        .name == "cred_theft" and .confidence != "low"
 52    ),
 53    // free email sender
 54    sender.email.domain.root_domain in $free_email_providers,
 55    network.whois(sender.email.domain).days_old < 30,
 56    not network.whois(sender.email.domain).found,
 57  
 58    // contains link to recently registered domain
 59    any(body.links, network.whois(.href_url.domain).days_old < 15),
 60    (
 61      regex.icontains(strings.replace_confusables(body.html.display_text),
 62                      '\b(?:u.?s.?p.?s|shipping|delivery)\b'
 63      )
 64      and not regex.icontains(body.html.display_text,
 65                              '\b(?:usps|shipping|delivery)\b'
 66      )
 67    ),
 68    any(body.links, regex.icontains(.href_url.url, 'https?://[0-9]{7,12}/.+')),
 69    (
 70      any(body.links,
 71          strings.icontains(.display_url.domain.root_domain, 'usps')
 72          and .mismatched
 73      )
 74    ),
 75    any(body.links, .href_url.domain.domain in $free_file_hosts)
 76  )
 77  and (
 78    sender.email.domain.root_domain not in (
 79      "usps.com",
 80      "opinions-inmoment.com", // https://faq.usps.com/s/article/USPS-Customer-Experience-Surveys
 81      "shipup.co", // third party shipping company
 82      "withings.com" // third party shipping company
 83    )
 84    or (
 85      sender.email.domain.root_domain in (
 86        "usps.com",
 87        "opinions-inmoment.com" // https://faq.usps.com/s/article/USPS-Customer-Experience-Surveys
 88      )
 89      and not headers.auth_summary.dmarc.pass
 90    )
 91  )
 92  // negate newsletters
 93  and (
 94    not (
 95      length(filter(body.links, .visible == true)) > 20
 96      or any(ml.nlu_classifier(body.html.display_text).topics,
 97             .name == "Newsletters and Digests"
 98      )
 99    )
100    or length(body.links) > length(body.current_thread.links) + 20
101  )
102  // not all links to usps.com
103  and not all(body.links, .href_url.domain.root_domain == "usps.com")
104  // negate legit forwards and replies
105  and not (
106    (subject.is_reply or subject.is_forward)
107    and length(body.previous_threads) > 0
108    and (length(headers.references) > 0 or headers.in_reply_to is not null)
109  )
110  // negate highly trusted sender domains unless they fail DMARC authentication
111  and (
112    (
113      sender.email.domain.root_domain in $high_trust_sender_root_domains
114      and not headers.auth_summary.dmarc.pass
115    )
116    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
117  )
118  and not any(body.links,
119              regex.icontains(.display_text, 'Track (?:Your Order|Shipment)')
120              and .href_url.domain.domain == 'tools.usps.com'
121  )
122  and not sender.email.domain.root_domain in ('shopifyemail.com')  
123attack_types:
124  - "Credential Phishing"
125tactics_and_techniques:
126  - "Image as content"
127  - "Impersonation: Brand"
128  - "Social engineering"
129detection_methods:
130  - "Computer Vision"
131  - "Content analysis"
132  - "Natural Language Understanding"
133  - "Sender analysis"
134id: "28b9130a-d8e0-50af-97c9-c1b8f4c46d68"