sublimemediumRule

Brand impersonation: Chase bank with credential phishing indicators

This rule checks for messages with or without attachments leveraging the Chase logo, and LinkAnalysis or Natural Language Understanding(NLU) has flagged credential phishing with medium to high confidence. The rule also excludes messages where all links are Chase affiliates, in addition to negating high trust sender root domains.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
and (
  (
    length(attachments) <= 3
    and any(attachments,
            .file_type in $file_types_images
            and any(ml.logo_detect(.).brands, .name == "Chase")
    )
  )
  or (
    length(attachments) == 0
    and any(ml.logo_detect(file.message_screenshot()).brands, .name == "Chase")
  )
)
and 0 < length(body.links) < 10
and (
  any(body.links,
      any([ml.link_analysis(.)],
          .credphish.disposition == "phishing"
          and .credphish.brand.confidence in ("medium", "high")
      )
  )
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name in ("cred_theft") and .confidence in ("medium", "high")
  )
)
and not all(body.links,
            .href_url.domain.root_domain in (
              "chasecdn.com",
              "chase.com",
              "chase.co.uk",
              "gslbjpmchase.com",
              "jpmorganchase.com",
              "jpmorgan.com",
              "jpmorganfunds.com",
              "jpmprivatebank.com",
              "paymentech.com"
            )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: Chase bank with credential phishing indicators"
description: "This rule checks for messages with or without attachments leveraging the Chase logo, and LinkAnalysis or Natural Language Understanding(NLU) has flagged credential phishing with medium to high confidence. The rule also excludes messages where all links are Chase affiliates, in addition to negating high trust sender root domains."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    (
      length(attachments) <= 3
      and any(attachments,
              .file_type in $file_types_images
              and any(ml.logo_detect(.).brands, .name == "Chase")
      )
    )
    or (
      length(attachments) == 0
      and any(ml.logo_detect(file.message_screenshot()).brands, .name == "Chase")
    )
  )
  and 0 < length(body.links) < 10
  and (
    any(body.links,
        any([ml.link_analysis(.)],
            .credphish.disposition == "phishing"
            and .credphish.brand.confidence in ("medium", "high")
        )
    )
    or any(ml.nlu_classifier(body.current_thread.text).intents,
           .name in ("cred_theft") and .confidence in ("medium", "high")
    )
  )
  and not all(body.links,
              .href_url.domain.root_domain in (
                "chasecdn.com",
                "chase.com",
                "chase.co.uk",
                "gslbjpmchase.com",
                "jpmorganchase.com",
                "jpmorgan.com",
                "jpmorganfunds.com",
                "jpmprivatebank.com",
                "paymentech.com"
              )
  )
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not headers.auth_summary.dmarc.pass
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
  and (
    not profile.by_sender().solicited
    or profile.by_sender().any_messages_malicious_or_spam
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Computer Vision"
  - "File analysis"
  - "Natural Language Understanding"
  - "Sender analysis"
  - "URL analysis"
id: "d9577856-0ea6-571b-a245-1dd367555e6a"