Sender: Suspicious CC suffix in sender display name

calendar Sep 16, 2026  ·
Share on: linkedin copy

Detects inbound messages where the sender's display name ends with a 'cc:' or 'CC:' suffix, a tactic often used to appear as though they're recipients rather than part of the attacker's sender identity.

Sublime rule (View on GitHub)

 1name: "Sender: Suspicious CC suffix in sender display name"
 2description: "Detects inbound messages where the sender's display name ends with a 'cc:' or 'CC:' suffix, a tactic often used to appear as though they're recipients rather than part of the attacker's sender identity."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.ends_with(sender.display_name, 'cc:', 'CC:')  
 8attack_types:
 9  - "BEC/Fraud"
10  - "Credential Phishing"
11tactics_and_techniques:
12  - "Social engineering"
13  - "Spoofing"
14detection_methods:
15  - "Sender analysis"
16id: "c656f255-8929-5c8f-a3ee-00193a1c1fb7"
to-top