Sublime Security high experimental mql

VIP impersonation: VIP recipient of previous thread with HTML generator

Detects inbound messages that impersonate invoice communications impersonating organizational VIPs, where the message appears in a thread previously involving VIP recipients. The rule identifies a specific template technique where the HTML body contains markers associated with 'Advanced HTML parser' tooling or a suspicious '<title>HTML Message</title>' tag. Both are artifacts commonly left by tools used to craft or obfuscate invoice lure content. Observed samples spoof leadership-recognition invoice themes naming specific executives as the invoiced party.

View Source

Detection Logic

type.inbound
and any(body.previous_threads,
        any(.recipients.to,
            any($org_vips,
                strings.icontains(..display_name, .display_name)
                or strings.icontains(..email.email, .email)
            )
        )
)
and (
  strings.icontains(body.html.raw, 'Advanced HTML parser')
  or regex.icontains(body.html.raw, '<title>\s*HTML Message\s*</title>')
)

Field Validations

Loading…

Comments (0)

Loading comments...