sublimemediumRule

Brand impersonation: Canada Revenue Agency

Detects messages impersonating the Canada Revenue Agency (CRA) in English or French that contain credential theft indicators. The rule identifies senders claiming to be CRA through display names or subject line references, uses natural language understanding to detect credential theft intent, and excludes legitimate senders with proper authentication.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1566.001 T1598 T1598.003

initial-access

Detection Query

type.inbound
and (
  // cred theft
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "cred_theft" and .confidence != 'low'
  )
  // contains a link not to the domain "canda.ca"
  or any(body.current_thread.links,
         .href_url.domain.root_domain not in ('canada.ca')
  )
  // contains any attachment that isn't an image
  or any(attachments, .file_type not in $file_types_images)
)

// sender claims to be CRA
and (
  strings.icontains(sender.display_name,
                    'canada revenue agency',
                    'agence du revenu du canada'
  )
  or (
    regex.icontains(sender.display_name, '\bcra\b')
    // limit it to samples that mention CRA by name in the body
    and regex.icontains(body.current_thread.text,
                        '(?:canada revenue|revenu du canada)'
    )
  )
)

// not a high trust or cra-arc.gc.ca
and not (
  (
    // negate highly trusted sender domains
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    // negate legit senders from legitimate cra
    or sender.email.domain.root_domain == "cra-arc.gc.ca"
  )
  // enforce authentication
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: Canada Revenue Agency"
description: "Detects messages impersonating the Canada Revenue Agency (CRA) in English or French that contain credential theft indicators. The rule identifies senders claiming to be CRA through display names or subject line references, uses natural language understanding to detect credential theft intent, and excludes legitimate senders with proper authentication."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    // cred theft
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != 'low'
    )
    // contains a link not to the domain "canda.ca"
    or any(body.current_thread.links,
           .href_url.domain.root_domain not in ('canada.ca')
    )
    // contains any attachment that isn't an image
    or any(attachments, .file_type not in $file_types_images)
  )

  // sender claims to be CRA
  and (
    strings.icontains(sender.display_name,
                      'canada revenue agency',
                      'agence du revenu du canada'
    )
    or (
      regex.icontains(sender.display_name, '\bcra\b')
      // limit it to samples that mention CRA by name in the body
      and regex.icontains(body.current_thread.text,
                          '(?:canada revenue|revenu du canada)'
      )
    )
  )

  // not a high trust or cra-arc.gc.ca
  and not (
    (
      // negate highly trusted sender domains
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      // negate legit senders from legitimate cra
      or sender.email.domain.root_domain == "cra-arc.gc.ca"
    )
    // enforce authentication
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Sender analysis"
id: "72607c4c-52dc-5df6-b547-54ee321b7a7a"