Skip to content

Commit 422a8a0

Browse files
github-actions[bot]github-actions[bot]
committed
[Test Rules] [PR sublime-security#4597] added rule: Brand impersonation: DHL
1 parent 394e0dd commit 422a8a0

1 file changed

Lines changed: 159 additions & 0 deletions

File tree

‎detection-rules/4597_impersonation_dhl.yml‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
name: "Brand impersonation: DHL"
2+
description: |
3+
Impersonation of the shipping provider DHL.
4+
references:
5+
- "https://www.helpnetsecurity.com/2020/08/21/q2-2020-email-security-trends/"
6+
- "https://www.dhl.com/ca-en/home/footer/fraud-awareness.html"
7+
type: "rule"
8+
severity: "low"
9+
source: |
10+
type.inbound
11+
and (
12+
regex.icontains(sender.display_name, '\bDHL\b')
13+
or regex.contains(sender.display_name, '\bD.{0,2}H.{0,2}L.{0,2}\b')
14+
or (
15+
strings.ilike(sender.email.domain.domain, '*DHL*')
16+
and length(sender.email.domain.domain) < 15
17+
)
18+
or strings.ilike(subject.subject, '*DHL notification*')
19+
or regex.icontains(subject.subject, 'dhl? express')
20+
or regex.contains(subject.subject, '\bD.{0,2}H.{0,2}L.{0,2}\b')
21+
or (
22+
any(ml.nlu_classifier(body.current_thread.text).topics,
23+
.name == "Shipping and Package" and .confidence == "high"
24+
)
25+
and strings.contains(body.current_thread.text, 'DHL ')
26+
)
27+
)
28+
and (
29+
any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency")
30+
or any(ml.nlu_classifier(body.current_thread.text).entities,
31+
.name == "org"
32+
and (
33+
.text =~ "DHL"
34+
or .text =~ "DHL Express"
35+
or strings.istarts_with(.text, "DHL International")
36+
)
37+
)
38+
or any(ml.logo_detect(file.message_screenshot()).brands,
39+
.name == "DHL" and .confidence in ("medium", "high")
40+
)
41+
or regex.icontains(body.current_thread.text, '\bDHL\b')
42+
// it contains a QR code
43+
or (
44+
//
45+
// This rule makes use of a beta feature and is subject to change without notice
46+
// using the beta feature in custom rules is not suggested until it has been formally released
47+
//
48+
beta.scan_qr(file.message_screenshot()).found
49+
and any(beta.scan_qr(file.message_screenshot()).items, .type == "url")
50+
)
51+
//
52+
// This rule makes use of a beta feature and is subject to change without notice
53+
// using the beta feature in custom rules is not suggested until it has been formally released
54+
//
55+
or strings.ilike(beta.ocr(file.message_screenshot()).text,
56+
"*package*",
57+
"*parcel*",
58+
"*shipping*",
59+
"*delivery*",
60+
"*track*"
61+
)
62+
or strings.ilike(body.current_thread.text,
63+
"*package*",
64+
"*parcel*",
65+
"*shipping*",
66+
"*delivery*",
67+
"*track*"
68+
)
69+
)
70+
and (
71+
(
72+
(
73+
length(headers.references) > 0
74+
or not any(headers.hops,
75+
any(.fields, strings.ilike(.name, "In-Reply-To"))
76+
)
77+
)
78+
and not (
79+
(
80+
strings.istarts_with(subject.subject, "RE:")
81+
or strings.istarts_with(subject.subject, "RES:")
82+
or strings.istarts_with(subject.subject, "R:")
83+
or strings.istarts_with(subject.subject, "ODG:")
84+
or strings.istarts_with(subject.subject, "答复:")
85+
or strings.istarts_with(subject.subject, "AW:")
86+
or strings.istarts_with(subject.subject, "TR:")
87+
or strings.istarts_with(subject.subject, "FWD:")
88+
or regex.imatch(subject.subject, '(\[[^\]]+\]\s?){0,3}(re|fwd?)\s?:')
89+
)
90+
)
91+
)
92+
or length(headers.references) == 0
93+
)
94+
and sender.email.domain.root_domain not in~ (
95+
'dhl.com',
96+
'dhl-news.com',
97+
'bdhllp.com',
98+
'dhlecommerce.co.uk',
99+
'dhlparcel.co.uk',
100+
'dhlecs.com',
101+
'dhl.co.uk',
102+
'dhl.co.tz',
103+
'dpdhl.com',
104+
'dhl.de',
105+
'dhl.fr',
106+
'dhl.pl',
107+
'dhlexpress.fr', // legit dhl site
108+
'dhlending.com',
109+
'inmotion.dhl',
110+
'dhlparcel.nl',
111+
'dhltariff.co.uk',
112+
'dhlindia-kyc.com',
113+
'dpogroup.com',
114+
'4flow-service.com', // shipping service
115+
'leaders-in-logistics.com', // legit sight for leadership webinar events
116+
'deutschepost.de', // German postal service
117+
'dhlecommerce.nl',
118+
'dhl.nl',
119+
'adhlawfirm.com', // similar name but unrelated
120+
'attendhlth.com', // dhl in domain but unrelated
121+
'tdhlaw.com', // dhl in domain but unrelated
122+
'hapibenefits.com', // DHL rewards program
123+
'dhlgpi.com', // DHL Australia
124+
'dhlfreight-news.com'
125+
)
126+
and not (
127+
sender.email.domain.tld in ('dhl')
128+
and coalesce(headers.auth_summary.dmarc.pass, false)
129+
)
130+
and (
131+
profile.by_sender().prevalence in ("new", "outlier")
132+
or (
133+
profile.by_sender().any_messages_malicious_or_spam
134+
and not profile.by_sender().any_messages_benign
135+
)
136+
)
137+
138+
// negate highly trusted sender domains unless they fail DMARC authentication
139+
and (
140+
(
141+
sender.email.domain.root_domain in $high_trust_sender_root_domains
142+
and not headers.auth_summary.dmarc.pass
143+
)
144+
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
145+
)
146+
147+
attack_types:
148+
- "Credential Phishing"
149+
tactics_and_techniques:
150+
- "Impersonation: Brand"
151+
- "Lookalike domain"
152+
- "Social engineering"
153+
detection_methods:
154+
- "Header analysis"
155+
- "Sender analysis"
156+
id: "2887b364-0153-5663-bbb0-11451ced2d4f"
157+
og_id: "be4b4ae0-d393-5f8b-b984-5cf4ad7cbeb5"
158+
testing_pr: 4597
159+
testing_sha: 595ad2f98905fce198ded75ecb58e618587374d8

0 commit comments

Comments
 (0)