VIP impersonation: Invoice fraud with mobile device sign-off

 1name: "VIP impersonation: Invoice fraud with mobile device sign-off"
 2description: "Detects inbound messages where a prior thread contains a reply from a known VIP - identifiable by display name or email address and signed off with a 'Sent from my iPhone' or 'Sent from my iPad' footer. However that VIP has been silently dropped from the current message's recipients. This pattern is consistent with fraudulent invoice and payment request lures where an attacker impersonates an internal executive in a thread, then removes them before requesting payment action from the remaining recipients."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(map(filter(body.previous_threads,
 8                     any($org_vips,
 9                         strings.icontains(..sender.display_name, .display_name)
10                         or (
11                           .email != ""
12                           and strings.icontains(..sender.email.email, .email)
13                         )
14                     )
15                     and (
16                       strings.iends_with(.text, "sent from my iphone.")
17                       or strings.iends_with(.text, "sent from my ipad.")
18                     )
19                     and (
20                       // any previous thread authored by the "VIP" has invoice/payment
21                       any(ml.nlu_classifier(.text, subject=.subject.base).tags,
22                           .name in ("invoice", "payment")
23                           and .confidence != "low"
24                       )
25                       or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
26                              .name in (
27                                "Request to View Invoice",
28                                "Payment Information"
29                              )
30                              and .confidence != "low"
31                       )
32  
33                       // if we don't get NLU but there is a W9 or Inv attached, we can assume it's invoice related
34                       or any(attachments,
35                              strings.istarts_with(.file_name, 'INV', "W-9", 'W9')
36                       )
37                     )
38              ),
39              .sender.email.email
40          ),
41          . == ""
42          or (
43            not strings.icontains(sender.email.email, .)
44            and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
45                        strings.icontains(.email.email, ..)
46            )
47          )
48  )  
49attack_types:
50  - "BEC/Fraud"
51tactics_and_techniques:
52  - "Impersonation: VIP"
53  - "Social engineering"
54detection_methods:
55  - "Content analysis"
56  - "Sender analysis"
57id: "7b3b9dcb-adcf-5335-813b-51f1a42cb4d6"