Brand impersonation: United States Patent and Trademark Office

 1name: "Brand impersonation: United States Patent and Trademark Office"
 2description: "Detects messages impersonating the United States Patent and Trademark Office (USPTO) using display name variations, confusable characters, or USPTO-related terminology in the sender or subject."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    regex.icontains(strings.replace_confusables(coalesce(sender.display_name, '')),
 9                    '\buspto\b|patent and trademark office|Trademark Electronic Application System',
10    )
11    or strings.ilike(sender.email.domain.domain, '*uspto*')
12  )
13  and sender.email.domain.root_domain != 'uspto.gov'
14  and length(body.links) >= 1
15  and not any(ml.nlu_classifier(body.current_thread.text).topics,
16              .name in (
17                'Newsletters and Digests',
18                'Advertising and Promotions',
19                'Events and Webinars'
20              )
21              and .confidence == 'high'
22  )
23  and not (
24    sender.email.domain.root_domain in $high_trust_sender_root_domains
25    and coalesce(headers.auth_summary.dmarc.pass, false)
26  )  
27attack_types:
28  - "BEC/Fraud"
29tactics_and_techniques:
30  - "Impersonation: Brand"
31  - "Social engineering"
32detection_methods:
33  - "Content analysis"
34  - "Header analysis"
35  - "Natural Language Understanding"
36  - "Sender analysis"
37  - "URL analysis"
38id: "96b2693c-4cae-5eb8-bb00-1d204f2f50c0"