diff --git a/detection-rules/brand_impersonation_metamask.yml b/detection-rules/brand_impersonation_metamask.yml
new file mode 100644
index 00000000000..b111c2ece84
--- /dev/null
+++ b/detection-rules/brand_impersonation_metamask.yml
@@ -0,0 +1,48 @@
+name: "Brand Impersonation: MetaMask"
+description: "Detects inbound messages containing links where the sender impersonates MetaMask through display name manipulation and includes the MetaMask logo or suspicious language, while not being from legitimate MetaMask domains. The rule checks for credential theft patterns and validates sender authentication."
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  and length(body.links) > 0
+  and (
+    regex.icontains(strings.replace_confusables(sender.display_name),
+                    '\bmetamask\b',
+                    '\bmetamask\.io\b'
+    )
+    or strings.ilevenshtein(strings.replace_confusables(sender.display_name),
+                            'metamask'
+    ) <= 2
+  )
+  and (
+    any(ml.logo_detect(beta.message_screenshot()).brands, .name == "MetaMask")
+    or any(ml.nlu_classifier(body.current_thread.text).intents,
+           .name in ("cred_theft", "callback_scam", "steal_pii")
+           and .confidence in ("high")
+    )
+  )
+  and sender.email.domain.root_domain not in~ ('metamask.io')
+
+  // negate highly trusted sender domains unless they fail DMARC authentication
+  and (
+    (
+      sender.email.domain.root_domain in $high_trust_sender_root_domains
+      and not headers.auth_summary.dmarc.pass
+    )
+    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
+  )
+  and not profile.by_sender().any_false_positives
+attack_types:
+  - "BEC/Fraud"
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Impersonation: Brand"
+  - "Social engineering"
+detection_methods:
+  - "Computer Vision"
+  - "Natural Language Understanding"
+  - "Sender analysis"
+  - "Header analysis"
+id: "ddb4c618-8ffb-5f01-963e-cd5b69e419b2"
+testing_pr: 2292
+testing_sha: 42e88cf521ce96480d59934fb3dd450677747f9b