Sync from PR#2292

Create brand_impersonation_metamask.yml by @aidenmitchell
#2292
Source SHA 42e88cf
Triggered by @aidenmitchell

detection-rules/brand_impersonation_metamask.yml

@@ -0,0 +1,48 @@
+name: "Brand Impersonation: MetaMask"
+description: "Detects inbound messages containing links where the sender impersonates MetaMask through display name manipulation and includes the MetaMask logo or suspicious language, while not being from legitimate MetaMask domains. The rule checks for credential theft patterns and validates sender authentication."
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  and length(body.links) > 0
+  and (
+    regex.icontains(strings.replace_confusables(sender.display_name),
+                    '\bmetamask\b',
+                    '\bmetamask\.io\b'
+    )
+    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
+                            'metamask'
+    ) <= 2
+  )
+  and (
+    any(ml.logo_detect(beta.message_screenshot()).brands, .name == "MetaMask")
+    or any(ml.nlu_classifier(body.current_thread.text).intents,
+           .name in ("cred_theft", "callback_scam", "steal_pii")
+           and .confidence in ("high")
+    )
+  )
+  and sender.email.domain.root_domain not in~ ('metamask.io')
+
+  // negate highly trusted sender domains unless they fail DMARC authentication
+  and (
+    (
+      sender.email.domain.root_domain in $high_trust_sender_root_domains
+      and not headers.auth_summary.dmarc.pass
+    )
+    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
+  )
+  and not profile.by_sender().any_false_positives
+attack_types:
+  - "BEC/Fraud"
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Impersonation: Brand"
+  - "Social engineering"
+detection_methods:
+  - "Computer Vision"
+  - "Natural Language Understanding"
+  - "Sender analysis"
+  - "Header analysis"
+id: "ddb4c618-8ffb-5f01-963e-cd5b69e419b2"
+testing_pr: 2292
+testing_sha: 42e88cf521ce96480d59934fb3dd450677747f9b