Phishing Scenario Rule Conditions

This topic describes the conditions that you can use to create rules and the default rules provided for the following phishing scenarios:

• Phishing domains
• Phishing websites
• Phishing Watch
• Best Practices for Phishing Domain Detection
• Reduce the number of phishing alerts
• Set a tailored severity calculation to Phishing alerts
• Using Regex expressions

For example, you can create a rule that will trigger alerts for only certain use cases, i.e. less alerts will be triggered than with the Threat Command Phishing Domain default-enabled rule. For more details, see Phishing domain Alert Profiler example.

Phishing domains

Phishing domains - Conditions

The following table describes the conditions that you can use to create rules.

When using a regular expression, don't enclose the expression in quotation marks.

Phishing domains - rules

The following table lists the rules that are provided to get you started quickly.

Phishing domain Alert Profiler example

An example of how to use the Alert Profiler for phishing domains could be to trigger alerts only for certain use cases. Also see the Best Practices for Phishing Domain Detection.

The following illustration shows how you can add conditions to the Threat Command Phishing Domain default rule to make alert triggering more selective. Alerts will be elevated only if they have a login page AND if the website content contains a specific regex list (“intsights” or “int-sights”):

Phishing websites

Phishing Websites - conditions

The following table describes the conditions that you can use to create rules.

When using a regular expression, don't enclose the expression in quotation marks.

Phishing Websites - rules

The following table lists the rules that are provided to get you started quickly.

Phishing websites Alert Profiler examples

These examples show how to use the Alert Profiler for phishing website threats.

Problem : The customer has a brand that is frequently targeted by phishing and other brands that are less targeted.

Solution : Add a condition (to the Detection algorithm) that alerts only on websites containing the targeted asset.

Customize alert triggering with the Alert profiler :

1. Edit the default rule, and change the "any " to "all."
2. Add the Asset name condition.
3. Add the parameters to select the targeted asset.

Problem : The customer is primarily targeted by phishing websites with a similar pattern (such as usage of certain hosting providers).

Solution : Add a condition (to the Detection algorithm) that alerts only on URLs (for example) that contain a certain pattern (defined by a Regex). Steps :

1. Edit the default rule, and change the "any " to "all."
2. Add the Website URL condition.
3. Add the parameters to define a Regex that will catch the troublesome hosts.

Phishing Watch

Phishing Watch - conditions

The following table describes the conditions that you can use to create rules.

When using a regular expression, don't enclose the expression in quotation marks.

For example, if the presence of an iframe should NOT trigger an alert, you can remove the ‘suspicious iframe’ condition, and keep the other conditions.

In addition, you can use any of the following conditions:

Phishing Watch - rules

The following table lists the rules that are provided to get you started quickly.

Best Practices for Phishing Domain Detection

Best-practice suggestions for using the Alert Profiler for phishing domain detection.

You can use the Alert Profiler to achieve the following:

• Reduce the number of phishing alerts and phishing false-positive alerts.
• Set a tailored severity calculation to phishing alerts.

Reduce the number of phishing alerts

The default Detection Algorithm looks for either of these matches, based on the Brand names, Company names, and Domains assets:

• The domain name is a permutation of any of these assets.
• The domain HTML content contains those exact assets.

Certain assets may create excess phishing alerts as well as many false-positive alerts. The first step in reducing the number of alerts is to review the Brand names, Company names, and Domains assets. If an asset is deemed to be “noisy,” you can exclude it from being detected.

To exclude assets from detection:

You can exclude noisy assets from triggering alerts by adding a condition to exclude that asset, on every existing or new rule.

In this example, the domain names “acme.one”, “insights3.com” and “intsights-demo.com” will be excluded:

Set a tailored severity calculation to Phishing alerts

Another way to enhance alert management is by tailoring the severity (Low, Medium, or High) assigned to triggered alerts. In addition to getting clearer classification, at the same time, you can prevent alert generation for threats that are less than your severity criteria.

The suggestions we present are just that - suggestions. You can use them as-is, modify them for your needs, or ignore them. Note that every rule includes the default Detection Algorithm, and triggers alerts only if they match that rule AND the added criteria. Low Severity The rule consists of two parts. A low-severity alert will be triggered if "all" conditions of either part (using an "any" condition) pass. Anything that does not match, minimally, will not generate an alert.

• Part A
  The default Detection algorithm [matches domains whose only connection is their name (a permutation of the asset) or their content (an exact match)] AND the domain is either expired (which indicates an opportunity to purchase the domain).

• Part B
  The default Detection algorithm [matches domains whose only connection is their name (a permutation of the asset) or their content (an exact match)] AND the domain is in a very basic stage of a possible phishing campaign.

Medium Severity A medium-severity alert will be triggered if a domain matches the default Detection algorithm [matches domains whose only connection is their name (a permutation of the asset) or their content (an exact match)] AND the domain is unexpired AND the domain is in a more mature stage of a possible phishing campaign.

High Severity A high-severity alert will be triggered if a domain matches the default Detection algorithm [matches domains whose only connection is their name (a permutation of the asset) or their content (an exact match)] AND the domain is expired AND it contains a login form. This indicates a live website that is possibly trying to phish company clients and employees. Other common conditions

The previous suggestions can be enhanced and modified by adding other conditions. Here are some examples to consider:

• Identify domain parking:

• Identify domain names with sector-related words (e.g. Banking):

• Identify domain names with common misleading permutations (polymorphic phishing). For example, "lntsights" (with a lower “L” instead of the 1^st “I”) or "Intslghts" (with a lower “L” instead of the 2^nd “I”):

Using Regex expressions

Many of the conditions enable the use of regex (Regular Expression) terms. This is a very popular and powerful way to define more exact searches.

For example, a company named "ION" would falsely match these names "international," "nation," and "ionic"

Using the following regex search, you can ensure that only matches for "ion" are matched:

• ^ finds only expressions that start exactly this way.
• $ finds only expressions that end exactly this way.

The previous example, as represented on https://regex101.com/: We recommend using any of the regex reference sites on the Web to learn more about regex.