Brand impersonation: SiriusXM

name: "Brand impersonation: SiriusXM"
description: "Impersonation of the broadcasting corporation SiriusXM."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    regex.icontains(sender.display_name, 'sirius[._-]?xm')
    or strings.ilevenshtein(sender.display_name, 'siriusxm') <= 1
    or strings.ilike(sender.email.domain.domain, '*siriusxm*')
    or (
      strings.istarts_with(body.current_thread.text, 'sirius xm')
      and regex.contains(body.current_thread.text,
                         '[\x{1F600}-\x{1F64F}]|[\x{1F300}-\x{1F5FF}]|[\x{1F680}-\x{1F6FF}]|[\x{1F1E0}-\x{1F1FF}]|[\x{2600}-\x{26FF}]|[\x{2700}-\x{27BF}]'
      )
    )
  )
  and (
    sender.email.domain.root_domain not in (
      'siriusxm.com',
      'siriusxmmedia.com',
      'siriusxm.ca',
      'engagement360.net', // SiriusXM survey vendor
      'sciquest.com' // SiriusXM Procurement
    )
    or (
      sender.email.domain.root_domain in (
        'siriusxm.com',
        'siriusxmmedia.com',
        'siriusxm.ca',
        'engagement360.net', // SiriusXM survey vendor
        'sciquest.com' // SiriusXM Procurement
      )
      and not headers.auth_summary.dmarc.pass
    )
  )
  and not profile.by_sender().solicited
  // negate highly trusted sender domains unless they fail DMARC authentication
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Callback Phishing"
  - "Credential Phishing"
  - "Spam"
tactics_and_techniques:
  - "Free email provider"
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Sender analysis"
id: "70eb3792-cd7a-5369-b1c3-65a3b772de00"