VIP impersonation: Fake forwarded indicator with VIP recipient impersonation

 1name: "VIP impersonation: Fake forwarded indicator with VIP recipient impersonation"
 2description: "Detects inbound messages that fabricate a forwarded email thread — using patterns like '=== Forwarded Message:' — where a prior thread appears to involve an organizational VIP as a recipient. The messages observed follow an invoice lure pattern referencing admired leadership figures by name, designed to create the appearance of legitimacy by spoofing internal executive communication chains."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(coalesce(body.plain.raw, body.html.display_text)) < 6000
 8  and (
 9    // the current thread contains a goofy forwarded message
10    (
11      strings.icontains(body.current_thread.text, 'forwarded')
12      // not this specific format
13      and not strings.icontains(body.current_thread.text,
14                                '============ Forwarded Message ============'
15      )
16      and regex.icontains(body.current_thread.text,
17                          '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
18                          '={3,}\s*(?:forwarded message|message that has been forwarded)',
19                          '[\x{2013}]{2,}\s*(?:forwarded message|message that has been forwarded)'
20      )
21    )
22    // any previous thread contains a goofy forwarded message
23    or any(body.previous_threads,
24           strings.icontains(.text, 'forwarded')
25           // not this specific format
26           and not strings.icontains(.text,
27                                     '============ Forwarded Message ============'
28           )
29           and regex.icontains(.text,
30                               '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
31                               '={3,}\s*(?:forwarded message|message that has been forwarded)',
32                               '[\x{2013}]{2,}\s*(?:forwarded message|message that has been forwarded)'
33           )
34    )
35  )
36  // any of the previous threads were sent to a VIP
37  and any(body.previous_threads,
38          any(.recipients.to,
39              any($org_vips,
40                  strings.icontains(..display_name, .display_name)
41                  or (.email != "" and strings.icontains(..email.email, .email))
42              )
43          )
44  )  
45attack_types:
46  - "BEC/Fraud"
47tactics_and_techniques:
48  - "Impersonation: VIP"
49  - "Social engineering"
50  - "Evasion"
51detection_methods:
52  - "Content analysis"
53  - "Sender analysis"
54id: "72630010-f8bd-5517-90ba-3b7c7dabc6e0"