Create impersonation_google_workspace.yml

[brycampbell]

Description

This rule is designed to detect the impersonation of Google Workspace, where the sample relies on logic inside the email including correct imagery, and excludes the forwaded contents (to spam@ or IT helpdesks)

• Sample 1
• Sample 2

Associated hunts

This hunt appears to be a specific limited campaign, so this rule will require additional coverage if its limited to this 2 day campaign

• Hunt 1

Screenshot (insights)

This image excludes sensitive recipients.

[brycampbell]

Here is a canonical of an interactive example:

17e01859-333e-4c3f-bafe-11a6e5635d67