• Sublime Core Feed
Medium Severity

Brand Impersonation: Chase bank with credential phishing indicators

Labels

Credential Phishing
Impersonation: Brand
Social engineering
Computer Vision
File analysis
Natural Language Understanding
Sender analysis
URL analysis

Description

This rule checks for messages with or without attachments leveraging the Chase logo, and LinkAnalysis or Natural Language Understanding(NLU) has flagged credential phishing with medium to high confidence. The rule also excludes messages where all links are Chase affiliates, in addition to negating high trust sender root domains.

References

No references.

Sublime Security
Created Nov 17th, 2023 • Last updated Apr 25th, 2024
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and (
  (
    length(attachments) <= 3
    and any(attachments,
            .file_type in $file_types_images
            and any(ml.logo_detect(.).brands, .name == "Chase")
    )
  )
  or (
    length(attachments) == 0
    and any(ml.logo_detect(beta.message_screenshot()).brands, .name == "Chase")
  )
)
and 0 < length(body.links) < 10
and (
  any(body.links,
      any([ml.link_analysis(.)],
          .credphish.disposition == "phishing"
          and .credphish.brand.confidence in ("medium", "high")
      )
  )
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name in ("cred_theft") and .confidence in ("medium", "high")
  )
)
and not all(body.links,
            .href_url.domain.root_domain in (
              "chasecdn.com",
              "chase.com",
              "chase.co.uk",
              "gslbjpmchase.com",
              "jpmorganchase.com",
              "jpmorgan.com",
              "jpmorganfunds.com",
              "jpmprivatebank.com",
              "paymentech.com"
            )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

and (
  not profile.by_sender().solicited
  or profile.by_sender().any_messages_malicious_or_spam
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started