Sublime Security high experimental mql

Impersonation: Australian Federal Police with criminal case language

Detects messages impersonating the Australian Federal Police using law enforcement terminology in the subject and sender display name, combined with official correspondence language including case references, investigation details, and compliance demands.

View Source

Detection Logic

type.inbound
and (
  strings.ilike(subject.base, '*afp*')
  or strings.ilike(subject.base, '*australian federal police*')
)
and (
  2 of (
    strings.ilike(subject.base, '*case*'),
    strings.ilike(subject.base, '*investigation*'),
    strings.ilike(subject.base, '*law enforcement*'),
    strings.ilike(subject.base, '*management*'),
    strings.ilike(subject.base, '*notice*'),
    strings.ilike(subject.base, '*reference*')
  )
)
and (
  regex.icontains(body.current_thread.text, 'investigation
| correspondence')
  and regex.icontains(body.current_thread.text, 'case (?:reference
| type)')
)

Field Validations

Loading…

Comments (0)

Loading comments...