Brand impersonation: Navan

name: "Brand impersonation: Navan"
description: "Impersonation of the expense management provider Navan."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    regex.icontains(sender.display_name, '(?:The\s+)?\bNavan\b(?:\s+Team)?')
    or strings.ilike(sender.email.domain.domain, '*Navan*')
    or 2 of (
      strings.icontains(body.current_thread.text, 'Navan'),
      strings.icontains(body.current_thread.text, '3045 Park Blvd'),
      strings.icontains(body.current_thread.text, 'Palo Alto, CA 94306')
    )
  )
  and (
    any(ml.logo_detect(file.message_screenshot()).brands,
        .name == "Navan" and .confidence in ("medium", "high")
    )
    or (
      regex.icontains(subject.subject,
                      "(?:unrecognized|Unusual|suspicious|unknown) (?:log|sign).?[io]n attempt",
                      "(?:important|urgent|attention|alert) account|accessed|[new|unrecognized|suspicious] location"
      )
      or any(ml.nlu_classifier(body.current_thread.text).entities,
             .name == "urgency"
      )
      or any(ml.nlu_classifier(body.current_thread.text).intents,
             .name in ("cred_theft", "steal_pii")
      )
    )
  )
  and sender.email.domain.root_domain not in~ ('navan.com')

  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not headers.auth_summary.dmarc.pass
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
  and (
    not profile.by_sender().solicited
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
  and not profile.by_sender().any_messages_benign
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "Sender analysis"
  - "Natural Language Understanding"
  - "URL analysis"
  - "Content analysis"
id: "3573e9a8-0ab7-5693-8386-8c75c95659b2"