Brand impersonation: FINRA

name: "Brand impersonation: FINRA"
description: |
  Impersonation of the Financial Industry Regulatory Authority (FINRA)
references:
  - "https://www.thinkadvisor.com/2020/05/04/finra-warns-of-email-phishing-scam/"
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    strings.ilevenshtein(sender.display_name, 'finra') <= 1
    or strings.ilevenshtein(sender.email.domain.sld, 'finra') <= 1
  )
  and any(ml.nlu_classifier(body.current_thread.text).entities,
          .name == "financial"
  )
  and length(ml.nlu_classifier(body.current_thread.text).intents) > 0
  and sender.email.domain.root_domain not in~ (
    'finra.org',
    'finrax.com',
    'finca.wine', // a wine company
    'finta.com' // unrelated domain caught by levenshtein 
  )
  and (
    (
      profile.by_sender().prevalence in ("new", "outlier")
      and not profile.by_sender().solicited
    )
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Lookalike domain"
  - "Social engineering"
detection_methods:
  - "Header analysis"
  - "Sender analysis"
id: "15c81db4-b3ba-5e9a-978c-194f77b56739"