sublimemediumRule

Attachment: Identity Confirmation With Document Unlock Code

Detects short inbound messages referencing an attached document that requires the recipient to confirm their identity and enter a code to unlock it, sent within an active thread context.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1027 T1573

initial-accessdefense-evasion

Detection Query

type.inbound
// confirm to unlock language
and strings.icontains(body.current_thread.text, "confirm your identity")
and strings.icontains(body.current_thread.text, "code to unlock document")
// and attached document
and strings.icontains(body.current_thread.text, "attached document")
// short message length
and length(body.current_thread.text) < 500
// plus previous threads
and length(body.previous_threads) > 1

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Identity Confirmation With Document Unlock Code"
description: "Detects short inbound messages referencing an attached document that requires the recipient to confirm their identity and enter a code to unlock it, sent within an active thread context."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // confirm to unlock language
  and strings.icontains(body.current_thread.text, "confirm your identity")
  and strings.icontains(body.current_thread.text, "code to unlock document")
  // and attached document
  and strings.icontains(body.current_thread.text, "attached document")
  // short message length
  and length(body.current_thread.text) < 500
  // plus previous threads
  and length(body.previous_threads) > 1
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Encryption"
  - "PDF"
detection_methods:
  - "Content analysis"
id: "27c9cbd8-68b4-528a-98df-92147e4aedb5"