Sublime Security high experimental mql

VIP impersonation: Fake forwarded indicator with VIP recipient impersonation

Detects inbound messages that fabricate a forwarded email thread — using patterns like '=== Forwarded Message:' — where a prior thread appears to involve an organizational VIP as a recipient. The messages observed follow an invoice lure pattern referencing admired leadership figures by name, designed to create the appearance of legitimacy by spoofing internal executive communication chains.

View Source

Detection Logic

type.inbound
and length(coalesce(body.plain.raw, body.html.display_text)) < 6000
and (
  // the current thread contains a goofy forwarded message
  (
    strings.icontains(body.current_thread.text, 'forwarded')
    // not this specific format
    and not strings.icontains(body.current_thread.text,
                              '============ Forwarded Message ============'
    )
    and regex.icontains(body.current_thread.text,
                        '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
                        '={3,}\s*(?:forwarded message
| message that has been forwarded)',
                        '[\x{2013}]{2,}\s*(?:forwarded message
| message that has been forwarded)'
    )
  )
  // any previous thread contains a goofy forwarded message
  or any(body.previous_threads,
         strings.icontains(.text, 'forwarded')
         // not this specific format
         and not strings.icontains(.text,
                                   '============ Forwarded Message ============'
         )
         and regex.icontains(.text,
                             '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
                             '={3,}\s*(?:forwarded message
| message that has been forwarded)',
                             '[\x{2013}]{2,}\s*(?:forwarded message
| message that has been forwarded)'
         )
  )
)
// any of the previous threads were sent to a VIP
and any(body.previous_threads,
        any(.recipients.to,
            any($org_vips,
                strings.icontains(..display_name, .display_name)
                or (.email != "" and strings.icontains(..email.email, .email))
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...