sublimehighRule

AnonymousFox indicators

Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields. This is indicative of messages sourced from an AnonymousFox compromised website.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1566.001 T1598 T1204.002 T1486

Detection Query

type.inbound
and (
  any(headers.hops,
      any(.fields,
          regex.icontains(.name, "^(X-Authenticated-Sender|X-Sender)")
          and regex.icontains(.value, "(anonymous|smtp)fox-")
      )
  )
  or regex.icontains(sender.email.email, "(anonymous|smtp)fox-")
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

https://sucuri.net/guides/anonymousfox-hack-guide/

Raw Content

name: "AnonymousFox indicators"
description: |
  Detects email messages that contain (anonymous|smtp)fox in the sender email address, X-Authenticated-Sender or X-Sender fields.
  This is indicative of messages sourced from an AnonymousFox compromised website. 
references:
  - "https://sucuri.net/guides/anonymousfox-hack-guide/"
type: "rule"
severity: "high"
source: |
  type.inbound
  and (
    any(headers.hops,
        any(.fields,
            regex.icontains(.name, "^(X-Authenticated-Sender|X-Sender)")
            and regex.icontains(.value, "(anonymous|smtp)fox-")
        )
    )
    or regex.icontains(sender.email.email, "(anonymous|smtp)fox-")
  )
attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
  - "Malware/Ransomware"
detection_methods:
  - "Header analysis"
  - "Sender analysis"
id: "2506206e-b879-57fa-bcfd-95c66eb02db8"