Brand impersonation: Fake Fax

  1name: "Brand impersonation: Fake Fax"
  2description: |
  3    Detects messages containing fax-related language and notification elements from senders outside of known legitimate fax service providers.
  4references:
  5  - "https://www.hoxhunt.com/blog/fax-phishing"
  6type: "rule"
  7severity: "medium"
  8source: |
  9  type.inbound
 10  // Subject or sender contains fax
 11  and (
 12    any([subject.subject, sender.display_name],
 13        regex.icontains(.,
 14                        '\bfax\b',
 15                        '[ve][[:punct:]]?fax',
 16                        '[[:punct:]]fax\b',
 17                        '\bfax[[:punct:]]',
 18                        'fr[[:punct:]].{0,25}document',
 19                        'e.?f.?a.?x'
 20        )
 21    )
 22  )
 23  and (
 24    // body.current_thread.text logic
 25    (
 26      ( // strong notification terms in either the subject or body.current_thread.text
 27        any([subject.subject, body.current_thread.text],
 28            strings.icontains(.,
 29                              "New Fax Received",
 30                              "e-Fax Document",
 31                              "Fax Status",
 32                              "Fax ID",
 33                              "Fax Message Delivered",
 34                              "Incoming Fax",
 35                              "New Fax Document"
 36            )
 37            or strings.istarts_with(., 'Fax message')
 38            or regex.icontains(.,
 39                               '(?:received|have) (a|(?:(.?\d.?))) (?:new )?e?fax',
 40                               "to view (th(?:e|is) )?(?:fax|message)",
 41                               'transmit(?:ted|ting)?(?:\s+\w+){0,2}\s+(?:fax|facsimile)',
 42                               '(?:fax|facsimile)\s+(?:\s+\w+){0,2}transmit(?:ted|ting)?',
 43                               'fax transmission (?:result|complete)'
 44            )
 45        )
 46        and (
 47          // combined with above, we should have very high confidence this is a fax message
 48          (
 49            // date
 50            strings.icontains(body.current_thread.text,
 51                              "Date:",
 52                              "Time Sent:",
 53                              "Time Received:",
 54                              "Received",
 55                              "Type: PDF"
 56            )
 57            // page count
 58            or regex.icontains(body.current_thread.text, "Num(ber)? of Pages?")
 59          )
 60          // commonly abused brands
 61          or (
 62            strings.icontains(body.current_thread.text,
 63                              "eFax is a registered trademark of Consensus"
 64            )
 65            or strings.icontains(body.current_thread.text, "RingCentral, Inc")
 66          )
 67          // there is a link with the display text of some CTA
 68          or any(body.links,
 69                 strings.icontains(.display_text, "open fax", "Open document")
 70                 // review document, view document review and sign document
 71                 or regex.icontains(.display_text,
 72                                    "(?:re)?view (?:(?:&|and) sign )?(?:complete )?document"
 73                 )
 74          )
 75        )
 76      )
 77      // attachment logic
 78      or (
 79        // the body.current_thread.text length is very short (probably just a warning banner)
 80        // and the attachment isn't used in the body of the message
 81        length(body.current_thread.text) < 300
 82        // and there are attachments
 83        and 0 < length(attachments) < 5
 84        // the attachments shouldn't be images which are used in the body of the html
 85        and any(attachments,
 86                strings.icontains(.file_name, 'fax')
 87                or (
 88                  // or they are used in the body and OCR on them contains fax wording
 89                  // the image is used in the HTML body
 90                  .file_type in $file_types_images
 91                  and (
 92                    any(regex.extract(.content_id, '^\<(.*)\>$'),
 93                        any(.groups,
 94                            strings.icontains(body.html.raw,
 95                                              strings.concat('src="cid:', ., '"')
 96                            )
 97                        )
 98                    )
 99                    or strings.icontains(body.html.raw, .content_id)
100                  )
101                  and (
102                    // and that image contains fax wording
103                    strings.icontains(beta.ocr(.).text,
104                                      "New Fax Received",
105                                      "New Fax Document"
106                    )
107                    or regex.icontains(beta.ocr(.).text,
108                                       "(?:received|have) a (?:new )?fax",
109                                       "to view (th(?:e|is) )?(?:fax|message)",
110                                       'transmit(?:ted|ting)?(?:\s+\w+){0,2}\s+(?:fax|facsimile)',
111                                       '(?:fax|facsimile)\s+(?:\s+\w+){0,2}transmit(?:ted|ting)?'
112                    )
113                  )
114                )
115        )
116      )
117    )
118  )
119  // negate known fax mailers
120  and not (
121    sender.email.domain.root_domain in (
122      "faxage.com",
123      'fax2mail.com',
124      'ringcentral.com',
125      'ringcentral.biz',
126      'avaya.com',
127      'egoldfax.com',
128      'efax.com',
129      'hellofax.com',
130      'mfax.io',
131      'goto.com',
132      'faxmessage.net',
133      'fuze.com',
134      'retarus.net',
135      'srfax.com',
136      'myfax.com',
137      '8x8.com',
138      'zoom.us',
139      'faxhd.com',
140      'humblefax.com',
141      'bridge.insure',
142      'telecomsvc.com'
143    )
144    and headers.auth_summary.dmarc.pass
145  )  
146
147attack_types:
148  - "Credential Phishing"
149tactics_and_techniques:
150  - "Impersonation: Brand"
151  - "Image as content"
152  - "Free file host"
153  - "Free subdomain host"
154  - "Social engineering"
155detection_methods:
156  - "Computer Vision"
157  - "Content analysis"
158  - "Optical Character Recognition"
159  - "Sender analysis"
160  - "URL analysis"
161id: "2a96b90a-64bf-52ad-b4e4-6f1e8c1dcba6"