Link: Fake forwarded message with suspicious URL in plain text

calendar Jul 20, 2026  ·
Share on: linkedin copy

Detects inbound plain text messages (no HTML body) with no prior thread history that contain a URL and are structured as a forwarded message. The rule checks for a 'Begin forwarded message' preamble, either standalone or followed by a From field matching the sender's display name, suggesting the message may be disguising its origin or delivering malicious links via forwarded message formatting.

Sublime rule (View on GitHub)

 1name: "Link: Fake forwarded message with suspicious URL in plain text"
 2description: "Detects inbound plain text messages (no HTML body) with no prior thread history that contain a URL and are structured as a forwarded message. The rule checks for a 'Begin forwarded message' preamble, either standalone or followed by a From field matching the sender's display name, suggesting the message may be disguising its origin or delivering malicious links via forwarded message formatting."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and body.html.raw is null
 8  and length(body.previous_threads) == 0
 9  and regex.contains(body.current_thread.text, 'https?://')
10  and (
11    regex.imatch(body.current_thread.preamble, 'begin forwarded message:\s*')
12    or (
13      regex.imatch(body.current_thread.preamble,
14                   'begin forwarded message:\s*from:\s*[^<@\n]+\s*'
15      )
16      and strings.icontains(body.current_thread.preamble, sender.display_name)
17    )
18  )  
19attack_types:
20  - "Credential Phishing"
21  - "BEC/Fraud"
22tactics_and_techniques:
23  - "Social engineering"
24  - "Evasion"
25detection_methods:
26  - "Content analysis"
27  - "Sender analysis"
28  - "URL analysis"
29id: "f325deee-62a4-5595-9d47-9729330b3245"
to-top