[Shared Samples] [PR #4685] added rule: PR# 4685 - Brand impersonation: Bids & Tenders

Author: github-actions[bot]

detection-rules/4685_brand_impersonation_bids_tenders.yml

@@ -0,0 +1,34 @@
+name: "PR# 4685 - Brand impersonation: Bids & Tenders"
+description: "Detects messages sent to self that contain links impersonating the Bids & Tenders platform. The rule identifies suspicious links from non-legitimate domains that load Bids & Tenders logo assets, suggesting the sender is spoofing the platform to appear legitimate."
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  // self sender
+  and (
+    length(recipients.to) == 1
+    and recipients.to[0].email.email == sender.email.email
+  )
+  and any(body.current_thread.links,
+          .href_url.domain.root_domain != 'bidsandtenders.ca'
+          and any(ml.link_analysis(.).unique_urls_accessed,
+                  .url == 'https://bids.bidsandtenders.ca/Resources/content/StandardTemplate/resources/Logo/BT_NewLogo_NameandSymol-colored.png'
+          )
+  )
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Impersonation: Brand"
+  - "Spoofing"
+  - "Social engineering"
+detection_methods:
+  - "Sender analysis"
+  - "URL analysis"
+  - "Content analysis"
+id: "e9caeb66-933e-5052-803a-6aa880e78f38"
+tags:
+  - created_from_open_prs
+  - rule_status_added
+  - pr_author_D-Bolton
+references:
+  - https://github.com/sublime-security/sublime-rules/pull/4685