Sublime Security high experimental mql

VIP impersonation: Invoice fraud with mobile device sign-off

Detects inbound messages where a prior thread contains a reply from a known VIP - identifiable by display name or email address and signed off with a 'Sent from my iPhone' or 'Sent from my iPad' footer. However that VIP has been silently dropped from the current message's recipients. This pattern is consistent with fraudulent invoice and payment request lures where an attacker impersonates an internal executive in a thread, then removes them before requesting payment action from the remaining recipients.

View Source

Detection Logic

type.inbound
and any(map(filter(body.previous_threads,
                   any($org_vips,
                       strings.icontains(..sender.display_name, .display_name)
                       or (
                         .email != ""
                         and strings.icontains(..sender.email.email, .email)
                       )
                   )
                   and (
                     strings.iends_with(.text, "sent from my iphone.")
                     or strings.iends_with(.text, "sent from my ipad.")
                   )
                   and (
                     // any previous thread authored by the "VIP" has invoice/payment
                     any(ml.nlu_classifier(.text, subject=.subject.base).tags,
                         .name in ("invoice", "payment")
                         and .confidence != "low"
                     )
                     or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
                            .name in (
                              "Request to View Invoice",
                              "Payment Information"
                            )
                            and .confidence != "low"
                     )

                     // if we don't get NLU but there is a W9 or Inv attached, we can assume it's invoice related
                     or any(attachments,
                            strings.istarts_with(.file_name, 'INV', "W-9", 'W9')
                     )
                   )
            ),
            .sender.email.email
        ),
        . == ""
        or (
          not strings.icontains(sender.email.email, .)
          and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
                      strings.icontains(.email.email, ..)
          )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...