sublimemediumRule

Credential phishing: Fake security alert from newly registered domain

Flags inbound messages from newly registered sender domains (less than 90 days old) that mimic account security notifications, referencing unusual sign-in or login activity, and containing multiple hallmark details such as IP address, device, location, or time—common indicators of credential phishing lures impersonating security alerts.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
and network.whois(sender.email.domain).days_old < 90
and any([subject.base, body.current_thread.text],
        regex.icontains(.,
                        'unusual (?:sign[-\s]in|login)',
                        'sign[-\s]in activity',
                        'account security (?:notice|alert)'
        )
)
and 2 of (
  strings.icontains(body.current_thread.text, 'ip address:'),
  strings.icontains(body.current_thread.text, 'device:'),
  strings.icontains(body.current_thread.text, 'no action is required'),
  regex.icontains(body.current_thread.text, 'location.{0,30}:'),
  regex.icontains(body.current_thread.text, '(?:date\s(?:and|&)\s)?time:')
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Credential phishing: Fake security alert from newly registered domain"
description: "Flags inbound messages from newly registered sender domains (less than 90 days old) that mimic account security notifications, referencing unusual sign-in or login activity, and containing multiple hallmark details such as IP address, device, location, or time—common indicators of credential phishing lures impersonating security alerts."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and network.whois(sender.email.domain).days_old < 90
  and any([subject.base, body.current_thread.text],
          regex.icontains(.,
                          'unusual (?:sign[-\s]in|login)',
                          'sign[-\s]in activity',
                          'account security (?:notice|alert)'
          )
  )
  and 2 of (
    strings.icontains(body.current_thread.text, 'ip address:'),
    strings.icontains(body.current_thread.text, 'device:'),
    strings.icontains(body.current_thread.text, 'no action is required'),
    regex.icontains(body.current_thread.text, 'location.{0,30}:'),
    regex.icontains(body.current_thread.text, '(?:date\s(?:and|&)\s)?time:')
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Impersonation: Brand"
detection_methods:
  - "Whois"
  - "Content analysis"
  - "Sender analysis"
id: "5c0adb9b-c553-5314-9774-becb52b7dd40"