sublimehighRule

VIP impersonation: Fake forwarded indicator with VIP recipient impersonation

Detects inbound messages that fabricate a forwarded email thread — using patterns like '=== Forwarded Message:' — where a prior thread appears to involve an organizational VIP as a recipient. The messages observed follow an invoice lure pattern referencing admired leadership figures by name, designed to create the appearance of legitimacy by spoofing internal executive communication chains.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and length(coalesce(body.plain.raw, body.html.display_text)) < 6000
and (
  // the current thread contains a goofy forwarded message
  (
    strings.icontains(body.current_thread.text, 'forwarded')
    // not this specific format
    and not strings.icontains(body.current_thread.text,
                              '============ Forwarded Message ============'
    )
    and regex.icontains(body.current_thread.text,
                        '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
                        '={3,}\s*(?:forwarded message|message that has been forwarded)',
                        '[\x{2013}]{2,}\s*(?:forwarded message|message that has been forwarded)'
    )
  )
  // any previous thread contains a goofy forwarded message
  or any(body.previous_threads,
         strings.icontains(.text, 'forwarded')
         // not this specific format
         and not strings.icontains(.text,
                                   '============ Forwarded Message ============'
         )
         and regex.icontains(.text,
                             '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
                             '={3,}\s*(?:forwarded message|message that has been forwarded)',
                             '[\x{2013}]{2,}\s*(?:forwarded message|message that has been forwarded)'
         )
  )
)
// any of the previous threads were sent to a VIP
and any(body.previous_threads,
        any(.recipients.to,
            any($org_vips,
                strings.icontains(..display_name, .display_name)
                or (.email != "" and strings.icontains(..email.email, .email))
            )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "VIP impersonation: Fake forwarded indicator with VIP recipient impersonation"
description: "Detects inbound messages that fabricate a forwarded email thread — using patterns like '=== Forwarded Message:' — where a prior thread appears to involve an organizational VIP as a recipient. The messages observed follow an invoice lure pattern referencing admired leadership figures by name, designed to create the appearance of legitimacy by spoofing internal executive communication chains."
type: "rule"
severity: "high"
source: |
  type.inbound
  and length(coalesce(body.plain.raw, body.html.display_text)) < 6000
  and (
    // the current thread contains a goofy forwarded message
    (
      strings.icontains(body.current_thread.text, 'forwarded')
      // not this specific format
      and not strings.icontains(body.current_thread.text,
                                '============ Forwarded Message ============'
      )
      and regex.icontains(body.current_thread.text,
                          '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
                          '={3,}\s*(?:forwarded message|message that has been forwarded)',
                          '[\x{2013}]{2,}\s*(?:forwarded message|message that has been forwarded)'
      )
    )
    // any previous thread contains a goofy forwarded message
    or any(body.previous_threads,
           strings.icontains(.text, 'forwarded')
           // not this specific format
           and not strings.icontains(.text,
                                     '============ Forwarded Message ============'
           )
           and regex.icontains(.text,
                               '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
                               '={3,}\s*(?:forwarded message|message that has been forwarded)',
                               '[\x{2013}]{2,}\s*(?:forwarded message|message that has been forwarded)'
           )
    )
  )
  // any of the previous threads were sent to a VIP
  and any(body.previous_threads,
          any(.recipients.to,
              any($org_vips,
                  strings.icontains(..display_name, .display_name)
                  or (.email != "" and strings.icontains(..email.email, .email))
              )
          )
  )
attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Impersonation: VIP"
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "Content analysis"
  - "Sender analysis"
id: "72630010-f8bd-5517-90ba-3b7c7dabc6e0"