sublimemediumRule

Body: Suspicious date format

Detects messages containing strage date formats observed in phishing emails.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and regex.icontains(body.current_thread.text,
                    'Date:\s(?:Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday)\s(?:January|February|March|April|May|June|July|August|September|October|November|December)\s202(?:5|6|7|8|9)'
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Body: Suspicious date format"
description: "Detects messages containing strage date formats observed in phishing emails."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and regex.icontains(body.current_thread.text,
                      'Date:\s(?:Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday)\s(?:January|February|March|April|May|June|July|August|September|October|November|December)\s202(?:5|6|7|8|9)'
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Spoofing"
  - "Social engineering"
detection_methods:
  - "Content analysis"
id: "36344c62-7437-5737-8f57-e509648fa2ae"