Brand impersonation: Aconex

calendar Oct 7, 2026  ·
Share on: linkedin copy

Detects messages impersonating Aconex that attempt to steal credentials, identified either through NLU classification of organization/sender entities combined with credential theft intent, or through keyword matching on terms like 'Support Central', 'Mail Number', 'Reference Number', and automated email disclaimers. Excludes messages from trusted Oracle/Aconex domains or other highly trusted sender domains that pass DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Aconex"
 2description: "Detects messages impersonating Aconex that attempt to steal credentials, identified either through NLU classification of organization/sender entities combined with credential theft intent, or through keyword matching on terms like 'Support Central', 'Mail Number', 'Reference Number', and automated email disclaimers. Excludes messages from trusted Oracle/Aconex domains or other highly trusted sender domains that pass DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      any(ml.nlu_classifier(body.current_thread.text).entities,
10          .name in ("org", "sender") and strings.icontains(.text, 'Aconex')
11      )
12      and any(ml.nlu_classifier(body.current_thread.text).intents,
13              .name == "cred_theft" and .confidence != "low"
14      )
15    )
16    or (
17      strings.icontains(body.current_thread.text, 'Aconex')
18      and 2 of (
19        strings.icontains(body.current_thread.text, 'Support Central'),
20        strings.icontains(body.current_thread.text,
21                          'This email is automatically generated'
22        ),
23        regex.icontains(body.current_thread.text, 'Mail Number'),
24        regex.icontains(body.current_thread.text, 'Reference Number')
25      )
26    )
27  )
28  and not (
29    sender.email.domain.root_domain in ("oracle.com", "aconex.com")
30    and coalesce(headers.auth_summary.dmarc.pass, false)
31  )
32  // negate highly trusted sender domains unless they fail DMARC authentication
33  and not (
34    sender.email.domain.root_domain in $high_trust_sender_root_domains
35    and coalesce(headers.auth_summary.dmarc.pass, false)
36  )
37    
38attack_types:
39  - "Credential Phishing"
40tactics_and_techniques:
41  - "Impersonation: Brand"
42  - "Social engineering"
43  - "Spoofing"
44detection_methods:
45  - "Natural Language Understanding"
46  - "Content analysis"
47  - "Header analysis"
48  - "Sender analysis"
49id: "1c55a0ad-a197-5407-8152-4d18f915a3ba"
to-top