Brand impersonation: Mailgun

name: "Brand impersonation: Mailgun"
description: "Impersonation of the Mailgun Email delivery platform."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    any([
          sender.display_name,
          sender.email.domain.domain,
          sender.email.local_part,
          subject.subject
        ],
        regex.icontains(strings.replace_confusables(.), "ma[il][il]gun")
    )
    or regex.icontains(body.html.raw,
                       '<title>.*mailgun.*</title>',
                       'alt\s*=\s*"\s*Mailgun\s*Logo\s*"'
    )
    or regex.icontains(body.current_thread.text,
                       '[©®]\s*(20\d\d\s*)?Mailgun',
                       'mailgun\s*[©®]'
    )
    or any(ml.logo_detect(file.message_screenshot()).brands,
           .name == "Mailgun" and .confidence in ("medium", "high")
    )
  )
  and not (
    // sent from mailgun actual
    (
      sender.email.domain.root_domain in (
        'mailgun.com',
        'mailgun.net', // official mailgun domains
        'sinch.com', // parent company of Mailgun
        'mailgunwarmup.com', // an unrelated b2b firm
        'emailonacid.com', // another sinch email product 
        'elior-na.com', // a domain with a simliar logo that catches on logo_detect
        'brembo.com' // a domain with a simliar logo that catches on logo_detect
      )
      and headers.auth_summary.dmarc.pass
    )
    // and not where the recipient include the domain with a simliar logo
    // and where that recipient shows up in a previous thread
    or (
      any(recipients.to,
          .email.domain.root_domain in ("elior-na.com", "brembo.com")
      )
      and any(filter(recipients.to,
                     .email.domain.root_domain in ("elior-na.com", "brembo.com")
              ),
              (
                strings.icontains(body.html.display_text,
                                  strings.concat("From: ", .email.email)
                )
                or strings.icontains(body.html.display_text,
                                     strings.concat("From: ", .display_name)
                )
              )
      )
    )
    or 
    // some domains have "mailgun" as a subdomain and are sent via mailgun
    // these are unlikely to be impersonations
    (
      (
        strings.icontains(sender.email.domain.domain, "mailgun")
        or strings.icontains(sender.email.local_part, "mailgun")
      )
      and (
        // if mailgun action was in the header.hops very likely not impersonation
        any(headers.domains, .root_domain in ('mailgun.com', 'mailgun.net'))
        // but if not and there are 4 or more X-Mailgun headers, likely not impersonation
        or sum(map(filter(headers.hops, .index < 2),
                   length(filter(.fields,
                                 strings.starts_with(.name, "X-Mailgun-")
                          )
                   )
               )
        ) >= 3
      )
    )
  )
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not headers.auth_summary.dmarc.pass
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Impersonation: Brand"
detection_methods:
  - "Sender analysis"
id: "59cc84e6-e16c-58e7-94ad-78dad315e5ab"