VIP local_part impersonation from unsolicited sender

 1name: "VIP local_part impersonation from unsolicited sender"
 2description: "This rule identifies potential impersonation attempts involving the local part of an $org_vip email address. Specifically, it checks for cases where the local part of an $org_vip email (e.g., local_part@domain.com) appears with a different domain (e.g., local_part@foreigndomain.com). Additionally, the rule flags messages that match an $org_vip address exactly but fail authentication."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and strings.contains(sender.email.local_part, ".")
 8  and any($org_vips,
 9          strings.starts_with(.email, sender.email.local_part)
10          and (
11            sender.email.email != .email
12            or (
13              sender.email.email == .email and not headers.auth_summary.dmarc.pass
14            )
15          )
16  )
17  and (
18    // ignore personal <> work emails
19    // where the sender and mailbox's display name are the same
20    length(recipients.to) > 0
21    or length(recipients.cc) > 0
22    or sender.display_name != mailbox.display_name
23  )
24  // bounce-back negations
25  and not strings.like(sender.email.local_part,
26                       "*postmaster*",
27                       "*mailer-daemon*",
28                       "*administrator*"
29  )
30  
31  // negate org domains unless they fail DMARC authentication
32  and (
33    (
34      sender.email.domain.root_domain in $org_domains
35      and not headers.auth_summary.dmarc.pass
36    )
37    or sender.email.domain.root_domain not in $org_domains
38  )
39  
40  // negate highly trusted sender domains unless they fail DMARC authentication
41  and not (
42    sender.email.domain.root_domain in $high_trust_sender_root_domains
43    and coalesce(headers.auth_summary.dmarc.pass, false)
44  )
45  // sender profile
46  and (
47    not profile.by_sender_email().solicited
48    or not profile.by_sender_email().any_messages_benign
49    or (
50      profile.by_sender_email().any_messages_malicious_or_spam
51      and not profile.by_sender_email().any_messages_benign
52    )
53    or (
54      sender.email.domain.domain in $org_domains
55      and not coalesce(headers.auth_summary.dmarc.pass, false)
56    )
57  )  
58tags:
59  - "Attack surface reduction"
60tactics_and_techniques:
61  - "Impersonation: VIP"
62  - "Spoofing"
63detection_methods:
64  - "Header analysis"
65  - "Sender analysis"
66id: "74035fdc-78c4-5a29-83d8-c1060ead4e28"