Brand impersonation: UK government Home Office

name: "Brand impersonation: UK government Home Office"
description: "Detects messages impersonating UK government agencies (Home Office, UK Visas and Immigration, gov.uk) that contain links not leading to legitimate gov.uk domains or show credential theft language, from senders not authenticated as official government domains."
type: "rule"
severity: "high"
source: |
  type.inbound
  
  // UK government agencies in display name or subject with homograph protection
  and (
    any([
          strings.replace_confusables(sender.display_name),
          strings.replace_confusables(subject.subject)
        ],
        strings.ilike(.,
                      "*sponsorship management system*",
                      "*Sponsor Management System*"
        )
        // exact match of high confidence
        or . in~ ("Home Office", "uk home office", "UK Visas and Immigration")
    )
    // image is srced from the actual home office URL
    or strings.icontains(body.html.raw,
                         '"https://www.points.homeoffice.gov.uk/gui-sms-jsf/images/'
    )
    // observed footers in messages
    or 2 of (
      strings.icontains(body.current_thread.text, '© Crown Copyright '),
      strings.icontains(body.current_thread.text, '© 2025 Home Office'),
      strings.icontains(body.current_thread.text, '© UK Visas and Immigration'),
      regex.icontains(body.current_thread.text, ' [||–-—] Home Office'),
      regex.icontains(body.current_thread.text,
                      ' [|–-—] UK Visas and Immigration'
      ),
      strings.icontains(body.current_thread.text,
                        'This is an automated message from UK Visas and Immigration.'
      ),
      strings.icontains(body.current_thread.text,
                        'This is an automated notification from the Home Office'
      ),
      regex.icontains(body.current_thread.text,
                      'You(?: are|''re) receiving this notification as a registered SMS user'
      ),
      regex.icontains(body.current_thread.text,
                      'If you are not the designated.{0,50}SMS user'
      ),
    )
  )
  
  //  Not from legitimate UK government domains
  and not (
    sender.email.domain.tld == "gov.uk" and headers.auth_summary.dmarc.pass
  )
  
  // 
  and (
    // there are links that do not link to "gov.uk"
    not all(body.links, .href_url.domain.tld == "gov.uk")
    // OR credential theft intent detected  
    or any(ml.nlu_classifier(body.current_thread.text).intents,
           .name == "cred_theft" and .confidence in ("medium", "high")
    )
    // link based indicators
    or any(body.links,
           // suspicious display text
           (
             .display_text in (
               "Access SMS",
               "Login to SMS",
               "Log in to SMS",
               "Access UKVI Account"
             )
             and .href_url.domain.tld != "gov.uk"
           )
           // there are mismatched links
           or (
             .display_url.domain.tld == "gov.uk"
             and .href_url.domain.tld != "gov.uk"
             and .mismatched
           )
  
           // the path refers to the uk stuff
           or (
             .href_url.domain.tld != "gov.uk"
             and strings.icontains(.href_url.path, 'gov.uk')
           )
    )
  )
  
  // no previous threads
  and not (length(headers.references) > 0 or length(body.previous_threads) > 0)
  // negate a high amount of links or newsletters
  and not (
    length(body.links) > 20
    or any(ml.nlu_classifier(body.html.display_text).topics,
           .name == "Newsletters and Digests"
    )
  )
  //  High-trust domain exclusion
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not headers.auth_summary.dmarc.pass
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
  - "Lookalike domain"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Natural Language Understanding"
  - "Sender analysis"
  - "URL analysis"
id: "f35d846a-5a72-56a7-9ee7-14cc8899ddff"