Credential theft with 'safe content' deception and social engineering topics

calendar Jan 5, 2026  ·
Share on: linkedin copy

Detects messages containing credential theft language combined with social engineering topics like secure messages, notifications, or authentication alerts. The rule specifically identifies emails that deceptively claim to be from a 'safe sender' or contain 'safe content' in the first line, which is a common tactic used to bypass security filters and gain user trust.

Sublime rule (View on GitHub)

 1name: "Credential theft with 'safe content' deception and social engineering topics"
 2description: "Detects messages containing credential theft language combined with social engineering topics like secure messages, notifications, or authentication alerts. The rule specifically identifies emails that deceptively claim to be from a 'safe sender' or contain 'safe content' in the first line, which is a common tactic used to bypass security filters and gain user trust."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(ml.nlu_classifier(body.current_thread.text).intents,
 8          .name == "cred_theft" and .confidence != "low"
 9  )
10  and (
11    any(ml.nlu_classifier(body.current_thread.text).topics,
12        .name in (
13          "Reminders and Notifications",
14          "Secure Message",
15          "Security and Authentication",
16          "Voicemail Call and Missed Call Notifications",
17          "E-Signature",
18          "Financial Communications"
19        )
20    )
21    or (
22      length(distinct(filter(ml.nlu_classifier(body.current_thread.text).entities,
23                             .name not in ("org", "recipient", "sender")
24                      ),
25                      .name
26             )
27      ) > 0
28      and all(distinct(filter(ml.nlu_classifier(body.current_thread.text).entities,
29                              .name not in ("org", "recipient", "sender")
30                       ),
31                       .name
32              ),
33              .name in ("request", "financial", "urgency")
34      )
35    )
36  )
37  and not any(ml.nlu_classifier(body.current_thread.text).topics,
38              .name in (
39                "Advertising and Promotions",
40                "Newsletters and Digests",
41                "News and Current Events",
42                "Travel and Transportation"
43              )
44  )
45  // check only the first line of the email
46  and any(regex.iextract(body.current_thread.text, "^[^\r\n]*"),
47          length(.full_match) < 500
48          and strings.ilike(.full_match,
49                            "*safe content*",
50                            "*safe sender*",
51                            "*trusted sender*"
52          )
53          and not regex.icontains(.full_match,
54                                  "add.{0,50} to.{0,50}(address book|safe senders? list)"
55          )
56  )  
57
58attack_types:
59  - "Credential Phishing"
60tactics_and_techniques:
61  - "Social engineering"
62  - "Evasion"
63detection_methods:
64  - "Content analysis"
65  - "Natural Language Understanding"
66id: "22ceee0d-1641-5f25-9034-a29b3fdade3d"
to-top