EXPLORE
Sign In
← Back to Explore
sublimehighRule

Attachment: Fake lawyer & sports agent identities

Detects messages containing attachments or content that reference known fake identities used in FC Barcelona scams, including fake lawyer Michael Gerardus Hermanus Demon and sports agents with the surname Giuffrida. The rule examines EXIF metadata, OCR text from attachments, and message body content for these specific identity markers.

MITRE ATT&CK

T1566.002T1534T1656T1566T1598
initial-access

Detection Query

type.inbound
and length(attachments) == 1
and beta.parse_exif(attachments[0]).creator == "Gabriele Giuffrida"

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

email
Raw Content
name: "Attachment: Fake lawyer & sports agent identities"
description: "Detects messages containing attachments or content that reference known fake identities used in FC Barcelona scams, including fake lawyer Michael Gerardus Hermanus Demon and sports agents with the surname Giuffrida. The rule examines EXIF metadata, OCR text from attachments, and message body content for these specific identity markers."
type: "rule"
severity: "high"
source: |
  type.inbound
  and length(attachments) == 1
  and beta.parse_exif(attachments[0]).creator == "Gabriele Giuffrida"
attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Impersonation: VIP"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Exif analysis"
  - "File analysis"
  - "Optical Character Recognition"
id: "7d3a2478-a373-50d6-97bb-2dd1c3f710f7"