Observed IOC: Malicious sender email addresses

name: "Observed IOC: Malicious sender email addresses"
description: "Detects inbound messages from known malicious sender email addresses. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
type: "rule"
severity: "high"
source: |
  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
  // Managed by automated IOC system
  type.inbound
  and hash.sha256(sender.email.email) in (
    '0004f01dc9ee385b299b774fbd0010c6da8164833d2ca0816ba648085e49051a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '0025925158ebaf2924dc24ff2d2c31c8613e2023b5bae2101cb1e752ff187eba', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '00b060930b9543a8e53680eeec51b8f0ea26171f841ba405b6a2bae4f4a16d13', // Observed malicious sender
    '01fb95a71c2e61353d73ad4b540297927f8c3c94cf82605e0362e9e08919241b', // Observed malicious sender
    '03f4447e4e825556bd7f47093b610e80f7962b0dfa62027b8e5f4315d7856d62', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '04ad2551e2fb00d428e8ea108ee3a793a68d4bdb23507909059d32456bc89175', // Observed malicious sender
    '054a555253046cedcbcec7ef343b0b7e3ad923a016c08c45e9346dba1bd30726', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '062a0829f242e71ffaa3943294a6f4e9f504510813a5ee83c457bce0c6c74e11', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '071e6532db98bebbb6d5ec4656f371c2f5237ef3ff6bc599804bd0160c7f9517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '072ad26b13508033eebde6e5070cf6d8aa09d7414d64da7b69bd82f6e8f683bb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '07447603538582dab2e8ee62920a7435cc9b756bcbc7f94054d373b6232460d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '0a9244cdee70d32d8065e20e52c7bd8dd5f45b1c9667f0a60f8b03e1398bbf71', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '0c79c4fa99676652637adf509395f6fb474922e08f1760b48d45acf37961a0a1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '0cb0ec45f1392918c2f720f262df8883ae5feb7f3f7fcab3e39a0c659dd29e55', // Observed malicious sender
    '0d7906e61f89af2bfbe63d749ec7681950410a81819baf307ed26a2a4ceb5605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '0e200a346995e3b0b8a339ddd57f439ce8d4961a5530ce4d8becbd17db562b08', // Observed malicious sender
    '0e353d693172e5409d8f7efca3f274a0f9c568142615a865ce013bb2cfdc71f7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '0efd3093b90370fa035b187a710e1bc2ae85705850260c3efdcf0e887ff8c9db', // Observed malicious sender
    '0fe6070072580c44577931b8b61febab507e1721439481777a3c8ef218950189', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '110e998853b48917bec1721e5de346da6bb59e56c81b3d7a7218521455321527', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '1127c5e25e2155b4e9a1aa7ebfd0269373697032eb6d037b2b1773636620777f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '12170cccd307602216eac235d3176f547ce89fb492eccbdbed19a2748f7264fb', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '12e43526e75cf27e10b97b0c1d7f673028450020031ada7e21525a12ad174724', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '131f2f1f4d53adf813008ef0442f741800589f6c80d2ed75022de3cbfb19699d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '16527a63209b668a15eb474b91b7bbb7a5c8282e4dcd8ce68044772677855c2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '16599313a98b7432e9756a1c4ab7693b454850ba025a23a656d15ed643fe2014', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '16944bb3724b4ecb0ffcfd5634fdc373b76891e6689e754154032777ebe12c6a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '1798bdb84f24fcc6b5442071fa1c405457ea5dcc73c3f0540e4280ebec041d3e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '18ac731a9858023e2b59114b6a861e10858c8d577ddf7ca7f7dd13984166a83e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '19c288bd2baa150a12078d1310c3094b2ddd7fda8ba42d283be861a50615a924', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '1a01ef4c29dcd924f903c6d2af54335acecf5e2289a41d69f1799005d07a8a0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '1a80fa436062f7deeea549b7f4d2b9db44c4ffef9d153fa8566a478de2876118', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '1acbc86f2347911378c5803f3fff4b2db5e8355ebd1a656e7da89cea3b4479e0', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '1b3f7a9f96d368268612f38aa535178ba2905ded7773a7dc15a93628bfc854e4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '1b7110520c715083c62cefd91b7129525ad1fcf5512fb78847e8eb16747ecd93', // Observed malicious sender
    '1f9f044f5f4f108480264b5df8b623215c9d2e425331a22d67e6709fce0bef0a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '2040a34f81cfa9b83e25fd49aa853ea55e2af03c2f6bb521d02babc94c25359d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '217fb9a42153586697f35abd87908d13cd821c1e90769b8f6601ece91455718d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '236f39a7019cf6e51a95de2074e17ffc6f5552c3c6c999cf34683b88915d756f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '2383fd0534e334243246377850eda12c5a29edff93259caa91e543acef30fcf4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '23c62826bbcf57ba73b802de9ff676e7c470ef20d3b6651a81b371fa3e00bbf1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '23d30b83c60509d03e79c2673ab0c1b9a9fe5dda07a2198df43038cb153d7ae7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '23d51790ce4482897006c98b3ad51e89731120ff5ffe550ef4e465495a6540bd', // Observed malicious sender
    '2428a08e180812cb74fb0930df94d299f444403a4cedc2fdb958e4de0ca72517', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '249fdecf8c13707087a66615e8777af844873136dca22dce66955a9fa0c62f54', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '273ead1b544583c83904a980ac566ca06c890ab5ce3e3099479d16ef8ee56421', // Observed malicious sender
    '282e90ee0f5ded51b49c9bf06be61ae70fe455282a3719ad2dba9aff3dc9757b', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '298e3bbd5441f58bf33082da80ae0229cd0fa17054e3432199414a4706d05bc8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '2bca99dc80ed69d4ff757ed3259882862b107fc6ecc72ce030123954aa896182', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '2d9d53c3991cd29ded163caaca5379f9ed2bad0e90cbee80f494a7003fc4ba29', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '30497db58c2865530f352d8605072c6cdcb553d496ab237fc3196f3133795c25', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '306bddcc8efbeed15553380ede95273d10438f4e4d8190963bd1cc58178560d1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '3190d9232f76f2636a06b1e39d934ddd23774e978ff5a5239eb4aa9eafd5e806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '36387b3610f581c3ff95f77130dc8faa8cf2046b0e610f4138bbe89651f4afff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '38347ae9a4c20cbd3d4908c29e5046d2ad5026a28e7d3ce482151ac7d2bf588c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '38a8e112af8d9252b3f51a8ba94003631bc4c9bf6ef60941521169382c8f546e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '3abf8f34e546677fd2a4ec081bcd6ec11d80fcadd49e83b342a9aec6fb723231', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '3c6d0480a53df3b3c3e2c27a210d99d9704e02814e1d11507e02490695eb8806', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '4249dea393334f7526450a59092d3ae3c2b57ce5473ac8c43700a1811b24b79a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '4364378d659a6b97ddec4f37fff2c59c7fabfc4e576fb5876ac2e9bcec31d542', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '43e610255bac2342a7f16f0a442962e8f9a13b90a37425d31ddbd88b058d0d9d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '45c0c14258e227b8c1b8cfaad30d10351bfa68c9a5e03a52927943b4f6049eff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '45df5110a927dc6160ee706784b4b3f75bc3f9154c75b3c28a524501a25943f5', // Observed malicious sender
    '48f87ee437793b1d2f8faf51dd2a5748f7a67f67fc0b168e861beeb28f371b59', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '4bd612d0513e4be9d62a13fff090a163b7fe55534ee8cd6a95b4f925d558210a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '4fc1f40c3dce21cdc1416a0932cdacd9b8cf20c6cd8993c3f5784bf4d6b9fc4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5072d99c5b7c54ed31bdacd396a646a237dc7921822f442a2d36bc63eb3ded7b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5088966877d8065394ac600df092d315bbb7e8a3ba18f1bc1e46bf12118bbc35', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '50ae47f0a347fc4f9403361b5626f2397657d768196afe7378fe613e9077102f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '521f15c8df742711d6a5e41077569037c45205d73b0ef79b6b7c7b1a947db397', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '54c49afa6a2b40d9ef8cef1be579a62fd941070d5d423ed44ca02d7a75c78f99', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '54e9c00529e925b43d578e8b1cb5efa2c634992ff871b98715b10d96b49c97c3', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5915f865d7aa335645d6eb8c6de4f2b555044da805cb699d7ef144ef7e4db0c1', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '597628907508fd4ba364bbe8113d950b95fe07511d077043c8a2b266e3cdedc7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5a13688445cbe7a317357c3965cc5cba2db610fb18eee85c8cef43937b9d0c0f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5a3e0172e9f47403a5211107fa7bf4f9e4c123db10bce71a56dd24dab210472b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5ab4530f353445bc3cd68b1131cb77abf71cbf2490f777190e2db6ff21fab7d1', // Observed malicious sender
    '5b508f66848ab601fd3544c927b095362b884ff7c96a863e5c4ca898b25ba290', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5b5be14defe0402d391348747d654cefa42685470bcea9080c1db55a7beacddb', // Observed malicious sender email
    '5c5ad5fda56f9659a2c1710d37f94eb2da19e941e75d9b59ccbd85b44a7b99ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5c693feb863201cf47f7845815eda91bb3f5cb80d0cca995f18c939fefecf21a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5e06e423fbf619f98f0aa67b0bce107c85e8e53e65e1c9a58997b306773cfadb', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '5ec704a8f5f01a6fa672656573abf9c70154a1a2af0a3123406afb3091ef0537', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '6057ccf37d8286e1ae7d8dfd1789fe60791f2bc39600631f0551712cc8661e5e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '637bfb85dc1f4f13ca89f1ecae0ea67745800e25d2ffe8a7ac89ac3fd961c944', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '63fc0efb6cb07fe669b6baff257143075488f457fa2571ab86d10e5316d66483', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '66771511747b19c3015adbbadd4e1d54d0db51c646f3c28b34b1fa09ee772afe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '6743c1d4689d9c0b1f807a7ae8b69676b42a6ce33df41ec51f471afe39c13367', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '682690942d17fcfdab558aeb4dc2731f51666adabfad813e1f4b6e3843a2c605', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '68e096fe2d9e586026cbe19d4b718ab64b0f4aae0aca3021c0f77e6f5e7512ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '69445041cb7a92d9283d016fe79f20ca740aa4244afa966df1f27c9c1f9ab0cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '69bb39e7e9fc344ed53bf59bf46ab39601ff098e1fe28730f5dbdb6dd5cc2e92', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '6a185db48b17bb707ad12cb0839babf4eebd45c2e648fb5606afb16fb64f9f4c', // Observed malicious sender
    '6ba83ae804722e49e6e3b876b5830dfe6044b5b8767aed9d5b2e2b168b835cde', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '6bcb6d890034877d208a211b2b2fc4e34e477a4a588c610f7ddd6d4fcad30821', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '6dd1daf7fab34d399a3307b0ab85a2c7d4ae4f9e42e0a226811f6d4d362b9d4c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '6f9a75a9a30c46798d67cf29265c8fb9255d05f9929156470c87e85a19f83254', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '7044b353baffec52f9de4bb653e76485c6829328443d7fbd6f38fdd160c16055', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '70855e72100e8ada3eddeacd781116929015ed87284dfdac46ec680ad4aaa193', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '70e1030db9d32f156df07d445ee2bdc71fa37d3e9cde4418c5db6e2560f711cc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '73267f82cfef50641282935512e3d291d2c681aebd58c8ba7950af8236626912', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '746f335cb574668d6e435e21e98a800e6b7bf92dde423963ef5aede5712ada2b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '7516a9a2ed9016192434dd81db055d23dccba29731343f12be7f7dcb324a439e', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '762c9ce5b716f3b385559fb09e7510661267797ea556eb866cbd1727424fdaca', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '766d628cd39125d9a6bce62dff3203cdc47d1a74e83f05157ad4fd28771974cd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '77dbd254b71aedc57d3247f9273b23a0ff191ebeafd4fe231048959f0191d524', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '7d3ecab1afc389186703af31545b4b7485ff20ad130167d641a178bf88850f1f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '7ecd366c4bc3213afe9374bf72d1e8151c1fcba1d1de800a7b9d9f58796835d1', // Observed malicious sender
    '7f6a1cadfd6cbdc412e25021725006324d84aeb4ba3e366d772e92887937bf15', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '8030cd12e522cf160c85171bfaee999d095e79bd66815d4604f5e4406a1c566c', // Observed malicious sender - multiple cred phish lures
    '80c2073c491f2330f6f9d87cfd0e9ca485ef3cb293c2fb8759a6edefa45ed0be', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '85041984096b0421bae2ee2f3d8b226f5d3335323af69ad44ff427059642856b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '89f1d71e971311f8d39a86a1bffa3b8c66f9e4c6569050af6424ae77d45242ec', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '8a47d2234827f5ded1d6bc235b16bf78b6f993c5799b4145888de15ba9a5e741', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '8b40a21077bb1d0807c9535d84fde1087d946d7a88b9025fe018bbdc6f08f23d', // Observed malicious sender
    '8ccd1976165c5acf2be6d44e89c95808574b584a2289354059554ba92f3ee355', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '8f70301abb6faa9b1b0463bda1a42a153a49c849dae45c24ca087b49cbd6f16f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '904e10d30ea2b3ba2f2a8b79645b18998e47d13258a03577242d65b3367fbd10', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '91af23121133f55ed3e3daa4f519c76565806472292d4cedbc2c2ceda0aff059', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '92b022313ffa3406da6cb095c2f8aa3404b401fea6ff9786f748663b9da6539f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '9472ab67914ca4eb86fb7c4b726bef67c194bbbd430871570e53ba148099c502', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '949999f91a3feac5a7b82ce881d1a32f8aea674ff928f5a7f8950076033272d7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '94a586de7ec274964f27506d5f27a6d717a1d472306017737ea067830889fb98', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '95f01da32fea6a5c28b5453568b7d3977a76e3ae42e7375534f22cd5c43c089a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '99673797051adaeb68dc8b07624ba300472cf9cff1a995fa1f95d8b6685374dc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '9b4bc1752d36bb4718a2a30342761e8ccecb5d64dc9164c3127dab30614811d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    '9ee9228bc6dcb8628d144d63c21d436f427719672dc1ff01e9f5845059424ea6', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a0d8f3435d51f1e452dd4cc99f533b718d52f32ceee0e4311fa0b721368b634b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a18ddb2b10a3a42bbbbc6300dce305703607cf9a12ed737da9f5576b879b1113', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a25568f7bea934cb12b3a5640e711701fc648b5d329c39f97af299e48f18451c', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a2bbaa6824197630b7b9fb12296405481f6d2224194559c1ee39a635f8603cfc', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a3e2ac92f5de8d20c54480ab3a61f33be788de8e9467bc18fc5e0b6a0d6da2ed', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a484fa16fb013b579b1f4006cc42d20da09541271c5f93312b4d02dbeba8385f', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a61e3cfff46af4b989c3b9ef15fc530d49b02833387503277c25701dc8240ed1', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a73aa957cd96d7cf65c2933636a5b88a10bd9223f43a493d7d030a67efab3e57', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a867247b8ccfc2299abe14585264d8a09bc1786f8ca4e2340ebf7c276b0b9af7', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a92c27104a2bd50691964990abd72d2115b676d1f840a27699b9c505290108f7', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'a9f9953ba7510a4ab38bc4602914b2d2aeb2679164494d984ca68b9e1b7d869b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'abd5ceb9b3abbd53544b99ded01b9a993c38b3133b0905d62006f8d378e5f8d8', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'aee561d4926ae4535a732b4649ea27a5ccef7a18b28775b162d095e11820a52c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b10df2f1de40412802796ec5895eff9c92880f378aa4f301608cc5dab1fc7515', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b2051a0fd6b19df331f4ee71671c8a6fc621544fb046574edd8233a585247d0a', // Observed malicious sender
    'b282f3e253bf6a2aa02d484f2edacc2f20338ce37fe157d8817ba96321af6766', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b2dfca515de73047279efe855337aa3c7d6179f7b0d7dc35921fb0377b618baf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b3413ce41fc413b11ba8fd0b58c71e3a811169cc2ac783154eaaf37e84fe7bbe', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b3e89ebfcc45a1fd5f254b8d04c5275d968af4618a7a8c5f6cc75b8d941bd448', // Compromised real account used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b45eb5412cc803dec77d6c7abea7ce0e6e3abc72ec75ac19a4f16c9cee65b91b', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b53cf0459ca41ca4c51c15d4be23113aeee4d77a77f7f01761e416b6896011b9', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b5a9dd56b5f7bc80c19c1f82b1bceb2d7e8bf42c1edf22346454c7c3a337d399', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b6df58873af5b6edde8f19e46bd7ed10bd0c7b61d4adda29506b05c5f0ef057a', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'b7281cf68223954ebe25b926a93d4073fa160430de9d90546bde6c34ff1418c5', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'bb24567ae519d6391aba7c28597fbf84a1c9b283bcd9e8d9383e4345c7ee0dcf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'c36ab707c4867b70407bfc0d9a4b069350080fdc820626f9a54f88ca905a3c97', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'c58703f9493a1ba83cfce49fc8afb2fbfc7442ea87abdeb74727a6b21e81d5ec', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'c7c688e8204b906d36f4ce1f8bab9238a5eed71d0e5021ac9966c63df027c2bc', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'ca2e7c13010d96bf2286342dc7ea87ec67232e29b5e659820210e01cef273081', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'cba8a0af5e7215c47dff6acf2a2e5bd0a52db3b52ba1bb6ced691087bfe5d593', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'ce2be5b5f5f2e6d1d9d8619c832e94cfa804ce4839d834d1af510a769e7a7d16', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'cf75ac0cb2baeaa1bf657101ca7ae0c300398509298f615e3d05fea7216da05c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'cfa974b119ad8212b484a0229914ff1405ca9b8c7489166420986b3576b7da7d', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'cfe6deedfb19c2b10e7b4d141a75421e34e846545dcbd4da67ccca4c28336cb2', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'd1105548f3549d3e676268efbdf0f0a419cba259317738f3a322f68a3b042461', // Observed malicious sender
    'd727d5b6cb6239d9d7a5549862d2fcbafe79efefe8f5f98f91d716a86653c06f', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'd74e6eddf9abd425d77adced3fb56eb96a164b2a56a28e0d75d08ede43d51cd4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'd7a310ef6cb3f4e842b17d268a52391675477f71475b63a4cf1cee6f9bd94ff5', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'd8a51f45c253a7032e8192237f8a8a070670f1631c5943a6bbd49dff5fef22a4', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'd9a21bdddc5bfebedafb827c71e3d014b64e68c18911e74a298352d7cc1fc552', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'd9b1a194be864f755ad19767c53bfc54dd27fb69464fc9d6b0729f4f82267f42', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'e02c4ad389225617a5fe12c012348a928f6c2159b378afb28d4d1f5f1e541376', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'e1509d8bf5ad644ed6eb5eb8cde1c5962ed8a3c18142ee753d24b185705facff', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'e1a4513ed83d89a26bd5216b871b8bfda892e5cce47f539a0c04f36e93cc0077', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'e2dd8628371377d56c761817ed6676c5ccd2e9870f1b8cb7b63467f0d387d8fd', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'e7c699fb15764decb4193d06537fd56d2ebb7e6af19919dd9b489815c200ea2c', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'e8a9768b0450f6383b427808fa6855e617e0f2210cfad339879a25f194aca25d', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'eb1e5843a298cfb84f6b443ee59e3e5385a9d047dccb2e2d568e71b8688d74a5', // Observed malicious sender
    'eb6fdf648b34efa0d7eed5ac971d12d2fbc5d8f8fa3c5d3abe7d307b3f1367f2', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'ed227a85dd447f006e6c34ffe955bfbfd864b88e0ef91ddfc1c7f5546bdf6f90', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'eeb6b71f9c3090dedbd6018df4edeb5d4c86f4819ab0223654ad44c32bac3503', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'f0d099bfdabc2c0ac8f8561a64d66e9e6ee1207fc560db8fe07771fbfa4bdd52', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'f12e13befd897b6b9ea41f1b299200fd71fb5137d6c0866f5af0984ac91a30cf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'f31d0f49475966eea47015c6ef2888a2d8805eef2df40805808ded010183f170', // Throwaway/lookalike sender address used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'f4116dde162ca98aeabba276d40e2d7306b4a63332b67dc994bf9278452a2c60', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'f47441d1d8080fd855a7ebc8ba3549958929f7d2acc70417438319bab03531bf', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'fa0038a882392e5496003d074ba4f627b377efe20e2cbe8aad9b8547b9222771', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'fa8ac775c0747999f0733c1197e1540b5db9e456a36014347c880b03a3b2aada', // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
    'fe218207660e4c9570cea198ab32c90af1e8ea7449f188b9f3683246a1808ca3', // Observed malicious sender
    'fff3c2530f6cc63385b2de940cc3e2c471561a3e5c28f77c650f203f1e86d6f0' // Free-mail persona used in VIP-impersonation invoice/payment BEC with fabricated reply threads
  )

attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Impersonation: Email address"
  - "Social engineering"
detection_methods:
  - "Sender analysis"
  - "Header analysis"
id: "b1c2d3e4-f5a6-4b8c-9d0e-f1a2b3c4d5e6"