sublimemediumRule

Brand impersonation: Kroger

Detects inbound messages that impersonate Kroger through a spoofed display name or local part while referencing loyalty program terms such as boost membership, renewal, verification, or points balance in the body or a rendered screenshot. Legitimate messages from verified Kroger domains or high trust senders that pass DMARC, as well as newsletters/digests, are excluded to reduce false positives.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1598.003

initial-access

Detection Query

type.inbound
and (
  regex.icontains(sender.display_name, 'kroger\b')
  or strings.istarts_with(sender.email.local_part, 'kroger')
)
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any([body.current_thread.text, beta.ocr(file.message_screenshot()).text],
        strings.icontains(., 'kroger')
        and (
          strings.icontains(.,
                            'boost membership',
                            'customer number',
                            'brief online survey',
                            'points balance',
                            'fuel savings',
                            'loyalty member',
                            'start survey',
                            'special member offer',
                            'loyalty program'
          )
          or regex.icontains(., 'shopping\s?cart reward')
        )
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
            .name in ("Newsletters and Digests", "Legal and Compliance")
)
and not (
  sender.email.domain.root_domain in (
    "kroger.com",
    "krogermail.com",
    "thekrogerco.com",
    "perkspot.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: Kroger"
description: "Detects inbound messages that impersonate Kroger through a spoofed display name or local part while referencing loyalty program terms such as boost membership, renewal, verification, or points balance in the body or a rendered screenshot. Legitimate messages from verified Kroger domains or high trust senders that pass DMARC, as well as newsletters/digests, are excluded to reduce false positives."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    regex.icontains(sender.display_name, 'kroger\b')
    or strings.istarts_with(sender.email.local_part, 'kroger')
  )
  //
  // This rule makes use of a beta feature and is subject to change without notice
  // using the beta feature in custom rules is not suggested until it has been formally released
  //
  and any([body.current_thread.text, beta.ocr(file.message_screenshot()).text],
          strings.icontains(., 'kroger')
          and (
            strings.icontains(.,
                              'boost membership',
                              'customer number',
                              'brief online survey',
                              'points balance',
                              'fuel savings',
                              'loyalty member',
                              'start survey',
                              'special member offer',
                              'loyalty program'
            )
            or regex.icontains(., 'shopping\s?cart reward')
          )
  )
  and not any(ml.nlu_classifier(body.current_thread.text).topics,
              .name in ("Newsletters and Digests", "Legal and Compliance")
  )
  and not (
    sender.email.domain.root_domain in (
      "kroger.com",
      "krogermail.com",
      "thekrogerco.com",
      "perkspot.com"
    )
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
  - "Image as content"
detection_methods:
  - "Sender analysis"
  - "Content analysis"
  - "Optical Character Recognition"
  - "Natural Language Understanding"
  - "Header analysis"
id: "23c90d6e-11bf-51a6-b34d-6de360f6f294"