Brand impersonation: MetaMask

name: "Brand impersonation: MetaMask"
description: "Detects inbound messages containing links where the sender impersonates MetaMask through display name manipulation and includes the MetaMask logo or suspicious language, while not being from legitimate MetaMask domains. The rule checks for credential theft patterns and validates sender authentication."
type: "rule"
severity: "high"
source: |
  type.inbound
  and length(body.links) > 0
  and (
    regex.icontains(strings.replace_confusables(sender.display_name),
                    '\bmetamask\b',
                    '\bmetamask\.io\b'
    )
    or strings.contains(strings.replace_confusables(sender.display_name),
                        "METAMASK"
    )
    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
                            'metamask'
    ) <= 2
    or any(ml.nlu_classifier(body.current_thread.text).entities,
           (.name == "sender" and strings.icontains(.text, 'metamask'))
           or (.name == "org" and regex.imatch(.text, '\bmetamask\s+\w+'))
    )
  )
  and (
    any(ml.logo_detect(file.message_screenshot()).brands, .name == "MetaMask")
    or any(ml.nlu_classifier(body.current_thread.text).intents,
           .name in ("cred_theft", "callback_scam", "steal_pii")
           and .confidence in ("high")
    )
  )
  and sender.email.domain.root_domain not in~ ('metamask.io')
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
  and not profile.by_sender().any_messages_benign

attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Computer Vision"
  - "Natural Language Understanding"
  - "Sender analysis"
  - "Header analysis"
id: "ddb4c618-8ffb-5f01-963e-cd5b69e419b2"