Service abuse: SendGrid impersonation via Sendgrid from new sender

 1name: "Service abuse: SendGrid impersonation via Sendgrid from new sender"
 2description: "Detects messages impersonating SendGrid from new senders, while routing through legitimate SendGrid infrastructure. This pattern is commonly used to abuse trusted email services for malicious purposes."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // SendGrid impersonation patterns
 8  and (
 9    strings.ilike(strings.replace_confusables(sender.display_name), '*sendgrid*')
10    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
11                            'sendgrid'
12    ) <= 1
13    or (
14      strings.ilike(strings.replace_confusables(sender.email.local_part),
15                    '*sendgrid*'
16      )
17      and (
18        sender.display_name is null
19        or strings.ilike(strings.replace_confusables(subject.base), '*sendgrid*')
20      )
21    )
22    or any(ml.logo_detect(file.message_screenshot()).brands,
23           .name == "SendGrid" and .confidence == "high"
24    )
25    or regex.icontains(body.current_thread.text, 'sendgrid\s*20[0-9]{2}')
26    or (
27      (
28        strings.icontains(body.current_thread.text, 'sendgrid')
29        or strings.icontains(sender.display_name, 'sendgrid')
30      )
31      and any(body.current_thread.links,
32              any(ml.link_analysis(., mode="aggressive").redirect_history,
33                  regex.match(.domain.sld, '[a-z]+-sendgrld')
34              )
35      )
36    )
37  )
38  // sent through a sendgrid account... sendgrid stamps X-SG-EID/X-SG-ID on every
39  // send, including white-labelled dedicated IPs that hide sendgrid.net
40  and any(headers.hops, any(.fields, .name in~ ("X-SG-EID", "X-SG-ID")))
41  // not common senders with valid domains
42  // this catches cases where the domain is invalid and senders become common
43  and not (
44    profile.by_sender_email().prevalence == "common" and sender.email.domain.valid
45  )
46  // negate legit sendgrid messages
47  and not (
48    sender.email.domain.root_domain in ("sendgrid.com", "kke.co.jp")
49    and coalesce(headers.auth_summary.dmarc.pass, false)
50  )  
51attack_types:
52  - "Credential Phishing"
53tactics_and_techniques:
54  - "Impersonation: Brand"
55  - "Social engineering"
56detection_methods:
57  - "Header analysis"
58  - "Sender analysis"
59id: "aa5d18ca-665a-5817-89d6-d76e29c44580"