Link: Fraudulent state business filing notice

 1name: "Link: Fraudulent state business filing notice"
 2description: "Detects inbound messages impersonating official state business compliance communications, such as Statements of Information or Certificates of Good Standing, that contain links to free subdomain hosting services. These messages use urgent language around filing deadlines or business suspensions to pressure recipients into clicking credential-harvesting links."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and not subject.is_reply
 8  and not subject.is_forward
 9  and 2 of (
10    strings.icontains(body.current_thread.text, "Statement of Information"),
11    strings.icontains(body.current_thread.text, "Secretary of State"),
12    regex.icontains(body.current_thread.text, 'filing (?:is )?overdue'),
13    strings.icontains(body.current_thread.text, "Certificate of Good Standing"),
14    strings.icontains(body.current_thread.text, "business suspension")
15  )
16  and any(body.current_thread.links,
17          .href_url.domain.root_domain in $free_subdomain_hosts
18  )
19  and any(ml.nlu_classifier(body.current_thread.text).intents,
20          .name == "cred_theft" and .confidence == "high"
21  )
22  // negate highly trusted sender domains unless they fail DMARC authentication
23  and not (
24    sender.email.domain.root_domain in $high_trust_sender_root_domains
25    and coalesce(headers.auth_summary.dmarc.pass, false)
26  )  
27attack_types:
28  - "Credential Phishing"
29tactics_and_techniques:
30  - "Free subdomain host"
31  - "Social engineering"
32  - "Impersonation: Brand"
33detection_methods:
34  - "Content analysis"
35  - "Natural Language Understanding"
36  - "URL analysis"
37id: "2bcd3785-6e1a-541d-9246-b2f43ad1510c"