VIP impersonation: Fake thread with VIPs missing email metadata

calendar Jul 13, 2026  ·
Share on: linkedin copy

Detects inbound messages that weaponize fabricated invoice or payment thread histories to impersonate or involve organizational VIPs. The rule identifies conversations where the two oldest visible threads discuss invoices, payments, or executive engagements, but contain incomplete sender or recipient email addresses — a hallmark of stitched-together or forged thread context. The targeted VIP appears in the fabricated thread history but is conspicuously absent from the current message's recipients, suggesting the VIP's name is being leveraged to establish false legitimacy while routing the live message away from their oversight. Matched messages span executive search retainer invoices, past-due account notices, wire transfer instructions, and advisory billing lures targeting named executives at known organizations.

Sublime rule (View on GitHub)

 1name: "VIP impersonation: Fake thread with VIPs missing email metadata"
 2description: "Detects inbound messages that weaponize fabricated invoice or payment thread histories to impersonate or involve organizational VIPs. The rule identifies conversations where the two oldest visible threads discuss invoices, payments, or executive engagements, but contain incomplete sender or recipient email addresses — a hallmark of stitched-together or forged thread context. The targeted VIP appears in the fabricated thread history but is conspicuously absent from the current message's recipients, suggesting the VIP's name is being leveraged to establish false legitimacy while routing the live message away from their oversight. Matched messages span executive search retainer invoices, past-due account notices, wire transfer instructions, and advisory billing lures targeting named executives at known organizations."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // we need at least two threads
 8  and length(body.previous_threads) > 1 
 9  // oldest thread is invoice/payment related
10  and (
11      any(ml.nlu_classifier(body.previous_threads[length(body.previous_threads)-1].text, subject=body.previous_threads[length(body.previous_threads)-1].subject.base).tags, .name in ("invoice", "payment") and .confidence != "low")
12      or any(ml.nlu_classifier(body.previous_threads[length(body.previous_threads)-1].text, subject=body.previous_threads[length(body.previous_threads)-1].subject.base).topics, .name in ("Request to View Invoice", "Payment Information") and .confidence != "low")
13  )
14  // second to oldest thread is invoice/payment related
15  and (
16      any(ml.nlu_classifier(body.previous_threads[length(body.previous_threads)-2].text, subject=body.previous_threads[length(body.previous_threads)-2].subject.base).tags, .name in ("invoice", "payment") and .confidence != "low")
17      or any(ml.nlu_classifier(body.previous_threads[length(body.previous_threads)-2].text, subject=body.previous_threads[length(body.previous_threads)-2].subject.base).topics, .name in ("Request to View Invoice", "Payment Information") and .confidence != "low")
18  )
19  // each of the two oldest threads have 1 or less recipients (sometimes the "to" header is missing)
20  and length(body.previous_threads[length(body.previous_threads) - 1].recipients.to) <= 1
21  and length(body.previous_threads[length(body.previous_threads) - 2].recipients.to) <= 1
22  // at least one party in the two oldest threads is missing an email
23  and (
24    body.previous_threads[length(body.previous_threads) - 1].sender.email.email == ""
25    or body.previous_threads[length(body.previous_threads) - 1].recipients.to[0].email.email == ""
26    or body.previous_threads[length(body.previous_threads) - 2].sender.email.email == ""
27    or body.previous_threads[length(body.previous_threads) - 2].recipients.to[0].email.email == ""
28  )
29  // an org vip sent/received messages
30  and any($org_vips,
31    ( body.previous_threads[length(body.previous_threads) - 1].recipients.to[0].display_name == .display_name
32      and body.previous_threads[length(body.previous_threads) - 2].sender.display_name == .display_name )
33    or ( body.previous_threads[length(body.previous_threads) - 1].sender.display_name == .display_name
34      and body.previous_threads[length(body.previous_threads) - 2].recipients.to[0].display_name == .display_name )
35  )
36  // the VIP is no longer in the current message
37  and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
38              any($org_vips,
39                  .email != ""
40                  and strings.icontains(..email.email, .email)
41                  and (
42                    ( body.previous_threads[length(body.previous_threads) - 1].recipients.to[0].display_name == .display_name
43                      and body.previous_threads[length(body.previous_threads) - 2].sender.display_name == .display_name )
44                    or ( body.previous_threads[length(body.previous_threads) - 1].sender.display_name == .display_name
45                      and body.previous_threads[length(body.previous_threads) - 2].recipients.to[0].display_name == .display_name )
46                  )))
47  // not from authorized senders on the org's domain
48  and not (sender.email.domain.domain in $org_domains and coalesce(headers.auth_summary.dmarc.pass, false))  
49attack_types:
50  - "BEC/Fraud"
51tactics_and_techniques:
52  - "Impersonation: VIP"
53  - "Social engineering"
54  - "Spoofing"
55detection_methods:
56  - "Natural Language Understanding"
57  - "Header analysis"
58  - "Content analysis"
59  - "Sender analysis"
60id: "44a68195-1d0d-5a9f-b984-994784f73eee"
to-top