Brand impersonation: Google Workspace alert notification

type.inbound

// Sender impersonates Google Workspace alerts but not from Google
and (
  regex.icontains(sender.display_name,
                  '(?:workspace|google\s*workspace).*(?:alert|notification)'
  )
  or regex.icontains(sender.display_name,
                     '(?:alert|notification).*(?:workspace|google\s*workspace)'
  )
  or regex.icontains(sender.email.local_part,
                     'workspace.*(?:alert|notification)'
  )
  or regex.icontains(sender.email.local_part, 'google.*workspace')
)
and not (
  sender.email.domain.root_domain in~ (
    'google.com',
    'google.co.uk',
    'google.ca'
  )
  and headers.auth_summary.dmarc.pass
)

// Negate legitimate Atlassian/Jira notifications that may contain Google Workspace content
and not (
  sender.email.domain.root_domain in~ ('atlassian.net', 'atlassian.com')
  and headers.auth_summary.dmarc.pass
)

// Negate legitimate Google alerts forwarded through mailing lists
and not (
  any(headers.hops,
      any(.fields,
          .name in ('X-Original-Sender', 'X-Original-From')
          and strings.ends_with(.value, '@google.com')
      )
  )
)

// Exclude Google Voice/phone call notifications
and not (
  regex.icontains(subject.subject,
                  '(?:phone\s*call|voice\s*mail|missed\s*call)'
  )
  or regex.icontains(body.current_thread.text, 'Google\s*Voice')
)

// Exclude forwarded messages
and not subject.is_forward

// Body contains Google Workspace impersonation patterns
and (
  // Alert center call to action with various phishing subjects
  (
    regex.icontains(body.current_thread.text, 'alert\s*cent(?:er|re)')
    and (
      regex.icontains(subject.subject,
                      'spike\s+in\s+(?:user[- ]?reported\s+)?spam'
      )
      or regex.icontains(subject.subject,
                         '(?:security|admin|workspace)\s+alert'
      )
      or regex.icontains(subject.subject,
                         'suspicious\s+(?:activity|login|access)'
      )
    )
  )
  // Reply-to address spoofs Google Workspace alerts
  or any(headers.reply_to,
         .email.email == 'google-workspace-alerts-noreply@google.com'
  )
  // Google Workspace logo hotlinked from gstatic
  or (
    strings.icontains(body.html.raw,
                      'gstatic.com/apps/signup/resources/google-workspace-lockup.png'
    )
    or strings.icontains(body.html.raw,
                         'gstatic.com/apps/signup/resources/google-workspace-lockup.svg'
    )
    or strings.icontains(body.html.raw,
                         'gstatic.com/apps/signup/resources/google-workspace-lockup.jpg'
    )
  )
  // Google corporate address
  or (
    strings.icontains(body.current_thread.text, '1600 Amphitheatre Parkway')
    and strings.icontains(body.current_thread.text, 'Mountain View, CA')
  )
  // Admin recipient messaging patterns
  or regex.icontains(body.current_thread.text, 'designated\s+admin\s+recipient')
  or (
    regex.icontains(body.current_thread.text,
                    'Google\s+Workspace(?:\s*account)?'
    )
    and regex.icontains(body.current_thread.text,
                        '(?:admin|administrator)\s+(?:console|recipient|account)'
    )
  )
  // Alert details structure common in these phishing attempts
  or (
    regex.icontains(body.current_thread.text, 'alert\s+details\s+include')
    and regex.icontains(body.current_thread.text,
                        '(?:activity\s+date|total\s+(?:user\s+)?reports|severity)'
    )
  )
)

// Contains links that are not to Google
and any(body.links,
        not .href_url.domain.root_domain in~ (
          'google.com',
          'google.co.uk',
          'google.ca',
          'gstatic.com',
          'googleusercontent.com',
          'sendgrid.net'
        )
)