Observed IOC: Malicious sender root domains

 1name: "Observed IOC: Malicious sender root domains"
 2description: "Detects inbound messages sent from known malicious sender root domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
 3type: "rule"
 4severity: "high"
 5source: |
 6  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
 7  // Managed by automated IOC system
 8  type.inbound
 9  and hash.sha256(sender.email.domain.root_domain) in (
10    '0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626', // Brand impersonation giveaways with AFF
11    '3991c7ffa06baf82403ffc1e0ab86cd370d3ae5607c9c2a39bad50919f63df99', // Compromised Google Workspace tenant - Attacker-provisioned mailboxes alongside real staff accounts sending document signing, credential expiry, tax and advance fee lures with no legitimate traffic observed
12    '3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786', // Brand impersonation giveaways with AFF
13    '4460762dd04ddb87f23a8b47ffb7190d24fc3e36990f990589e93a8fc706ef16', // Attacker-controlled domain - Wix and registrar impersonation domain renewal credential phishing from rotating local parts
14    '48e4bf2fd8bd7c31e22ab2f44156457c3f5aeb861540b479341ab8982e7c5271', // Attacker-controlled domain - Credential phishing and fake document notifications sent via Amazon SES from rotating no-reply local parts
15    '62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec', // Brand impersonation giveaways with AFF
16    '674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff', // Brand impersonation giveaways with AFF
17    '724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268', // Brand impersonation giveaways with AFF
18    '91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b', // Brand impersonation giveaways with AFF
19    '9d99b871bd0509fa8df745dda56f6f69df0a0687bec41e70050e6b1637954d3f', // Attacker-controlled domain - Registrar suspension notice credential phishing from rotating local parts
20    'a40015c5fe61ff49ad076af6ad2e48ec1a46546903b6cb2b80047ee4a72f4c8e', // Brand impersonation - Google Authenticator lookalike sending fake 2FA codes and new sign-in alerts
21    'a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36', // Brand impersonation giveaways with AFF
22    'ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d', // Brand impersonation giveaways with AFF
23    'afe1d7af2895d42dc38a3271120aaf9af4cb48a322ece33d034c25d7600069fe', // Attacker-controlled domain - Open redirect and Teams meeting credential phishing from randomized and no-reply local parts with no legitimate traffic observed
24    'c4c2e8a023cd5534ed1b261296f0174faf498924facf3e75c36e4a5820a14b0f', // Attacker-controlled lookalike domain - Okta MFA reset credential phishing
25    'd3edb97274598d61a51255e547fa5819a0c18436e3de2c5e8233025ea22a8a2d', // Attacker-controlled domain - Title order and payoff statement escrow wire fraud with Chase branding from rotating local parts
26    'e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78', // Brand impersonation giveaways with AFF
27    'e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f' // Brand impersonation giveaways with AFF
28  )  
29
30attack_types:
31  - "BEC/Fraud"
32  - "Credential Phishing"
33  - "Malware/Ransomware"
34tactics_and_techniques:
35  - "Impersonation: Domain"
36  - "Social engineering"
37detection_methods:
38  - "Sender analysis"
39  - "Header analysis"
40id: "d3e4f5a6-b7c8-4d0e-bf2a-b3c4d5e6f7a8"