sublimehighRule

Impersonation: Australian Federal Police with criminal case language

Detects messages impersonating the Australian Federal Police using law enforcement terminology in the subject and sender display name, combined with official correspondence language including case references, investigation details, and compliance demands.

MITRE ATT&CK

T1566.002 T1534 T1656 T1486 T1657 T1598.003 T1566 T1598

initial-access

Detection Query

type.inbound
and (
  strings.ilike(subject.base, '*afp*')
  or strings.ilike(subject.base, '*australian federal police*')
)
and (
  2 of (
    strings.ilike(subject.base, '*case*'),
    strings.ilike(subject.base, '*investigation*'),
    strings.ilike(subject.base, '*law enforcement*'),
    strings.ilike(subject.base, '*management*'),
    strings.ilike(subject.base, '*notice*'),
    strings.ilike(subject.base, '*reference*')
  )
)
and (
  regex.icontains(body.current_thread.text, 'investigation|correspondence')
  and regex.icontains(body.current_thread.text, 'case (?:reference|type)')
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Impersonation: Australian Federal Police with criminal case language"
description: "Detects messages impersonating the Australian Federal Police using law enforcement terminology in the subject and sender display name, combined with official correspondence language including case references, investigation details, and compliance demands."
type: "rule"
severity: "high"
source: |
  type.inbound
  and (
    strings.ilike(subject.base, '*afp*')
    or strings.ilike(subject.base, '*australian federal police*')
  )
  and (
    2 of (
      strings.ilike(subject.base, '*case*'),
      strings.ilike(subject.base, '*investigation*'),
      strings.ilike(subject.base, '*law enforcement*'),
      strings.ilike(subject.base, '*management*'),
      strings.ilike(subject.base, '*notice*'),
      strings.ilike(subject.base, '*reference*')
    )
  )
  and (
    regex.icontains(body.current_thread.text, 'investigation|correspondence')
    and regex.icontains(body.current_thread.text, 'case (?:reference|type)')
  )

attack_types:
  - "BEC/Fraud"
  - "Extortion"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Natural Language Understanding"
  - "Sender analysis"
id: "1f712b4c-597b-53a4-b9b8-fc3d77d9086e"