sublimehighRule

VIP impersonation: VIP recipient of previous thread with HTML generator

Detects inbound messages that impersonate invoice communications impersonating organizational VIPs, where the message appears in a thread previously involving VIP recipients. The rule identifies a specific template technique where the HTML body contains markers associated with 'Advanced HTML parser' tooling or a suspicious '<title>HTML Message</title>' tag. Both are artifacts commonly left by tools used to craft or obfuscate invoice lure content. Observed samples spoof leadership-recognition invoice themes naming specific executives as the invoiced party.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and any(body.previous_threads,
        any(.recipients.to,
            any($org_vips,
                strings.icontains(..display_name, .display_name)
                or strings.icontains(..email.email, .email)
            )
        )
)
and (
  strings.icontains(body.html.raw, 'Advanced HTML parser')
  or regex.icontains(body.html.raw, '<title>\s*HTML Message\s*</title>')
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "VIP impersonation: VIP recipient of previous thread with HTML generator"
description: "Detects inbound messages that impersonate invoice communications impersonating organizational VIPs, where the message appears in a thread previously involving VIP recipients. The rule identifies a specific template technique where the HTML body contains markers associated with 'Advanced HTML parser' tooling or a suspicious '<title>HTML Message</title>' tag. Both are artifacts commonly left by tools used to craft or obfuscate invoice lure content. Observed samples spoof leadership-recognition invoice themes naming specific executives as the invoiced party."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(body.previous_threads,
          any(.recipients.to,
              any($org_vips,
                  strings.icontains(..display_name, .display_name)
                  or strings.icontains(..email.email, .email)
              )
          )
  )
  and (
    strings.icontains(body.html.raw, 'Advanced HTML parser')
    or regex.icontains(body.html.raw, '<title>\s*HTML Message\s*</title>')
  )
attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Impersonation: VIP"
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "HTML analysis"
  - "Content analysis"
  - "Sender analysis"
id: "77839c4f-2c61-5360-ade4-a32a211340e0"