sublimemediumRule

Link: Fake forwarded message with suspicious URL in plain text

Detects inbound plain text messages (no HTML body) with no prior thread history that contain a URL and are structured as a forwarded message. The rule checks for a 'Begin forwarded message' preamble, either standalone or followed by a From field matching the sender's display name, suggesting the message may be disguising its origin or delivering malicious links via forwarded message formatting.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and body.html.raw is null
and length(body.previous_threads) == 0
and regex.contains(body.current_thread.text, 'https?://')
and (
  regex.imatch(body.current_thread.preamble, 'begin forwarded message:\s*')
  or (
    regex.imatch(body.current_thread.preamble,
                 'begin forwarded message:\s*from:\s*[^<@\n]+\s*'
    )
    and strings.icontains(body.current_thread.preamble, sender.display_name)
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Fake forwarded message with suspicious URL in plain text"
description: "Detects inbound plain text messages (no HTML body) with no prior thread history that contain a URL and are structured as a forwarded message. The rule checks for a 'Begin forwarded message' preamble, either standalone or followed by a From field matching the sender's display name, suggesting the message may be disguising its origin or delivering malicious links via forwarded message formatting."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and body.html.raw is null
  and length(body.previous_threads) == 0
  and regex.contains(body.current_thread.text, 'https?://')
  and (
    regex.imatch(body.current_thread.preamble, 'begin forwarded message:\s*')
    or (
      regex.imatch(body.current_thread.preamble,
                   'begin forwarded message:\s*from:\s*[^<@\n]+\s*'
      )
      and strings.icontains(body.current_thread.preamble, sender.display_name)
    )
  )
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "Content analysis"
  - "Sender analysis"
  - "URL analysis"
id: "f325deee-62a4-5595-9d47-9729330b3245"