Skip to content

Update impersonation_social_security_admin.yml #3465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update impersonation_social_security_admin.yml #3465

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 32 additions & 5 deletions detection-rules/impersonation_social_security_admin.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,22 +4,34 @@ type: "rule"
severity: "medium"
source: |
type.inbound

and length(attachments) < 2
// Identifies as SSA without catching strings such as "Alyssa"
and (
regex.contains(sender.display_name, '^SSA\b')
or strings.icontains(sender.display_name, "Social Security Administration")
// there are confusables in the display name
or (
strings.replace_confusables(sender.display_name) != sender.display_name
and strings.contains(strings.replace_confusables(sender.display_name), "SSA")
and strings.contains(strings.replace_confusables(sender.display_name),
"SSA"
)
)
or any([sender.display_name, subject.subject],
regex.icontains(strings.replace_confusables(.), 'Social (?:benefits|security)', )
regex.icontains(strings.replace_confusables(.),
'Social (?:benefits|security)',
)
)
or (
any(attachments,
.file_type in ("doc", "docx")
and any(file.explode(.),
strings.icontains(.scan.strings.raw,
"Social Security Administration"
)
)
)
)
)
// Contains a link
and length(body.links) >= 1

// Not from a .gov domain
and not (sender.email.domain.tld == "gov" and headers.auth_summary.dmarc.pass)
Expand All @@ -44,6 +56,21 @@ source: |
or any(ml.logo_detect(file.message_screenshot()).brands,
.name == "SSA" and .confidence == "high"
)
or (
any(attachments,
.file_type in ("doc", "docx")
and any(file.explode(.),
strings.icontains(.scan.strings.raw, "suspended")
or strings.icontains(.scan.strings.raw, "fraudulent")
or strings.icontains(.scan.strings.raw, "violated")
or strings.icontains(.scan.strings.raw, "false identity")
or regex.icontains(.scan.strings.raw,
'\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
'\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
)
)
)
)
)
and not any(ml.nlu_classifier(body.current_thread.text).topics,
.name in (
Expand Down
Loading