From 7ead39800110d522b37d0191a99f04c452f59452 Mon Sep 17 00:00:00 2001 From: Brandon Murphy <4827852+zoomequipd@users.noreply.github.com> Date: Sat, 4 Jul 2026 15:01:12 -0500 Subject: [PATCH 1/4] Create vip_impersonation_prev_thread_space_colon.yml --- ..._impersonation_prev_thread_space_colon.yml | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 detection-rules/vip_impersonation_prev_thread_space_colon.yml diff --git a/detection-rules/vip_impersonation_prev_thread_space_colon.yml b/detection-rules/vip_impersonation_prev_thread_space_colon.yml new file mode 100644 index 00000000000..ffadb090ac7 --- /dev/null +++ b/detection-rules/vip_impersonation_prev_thread_space_colon.yml @@ -0,0 +1,63 @@ +name: "VIP Impersonation: Fabricated thread history with fake VIP recipients" +description: "Detects inbound messages that contain forged prior thread histories where the fake headers use abnormal spacing around colons - a hallmark of programmatically generated preambles. The fabricated threads reference VIP recipients from the organization who are absent from the live message's actual recipients, suggesting the thread was constructed to manufacture legitimacy. Observed messages impersonate finance or accounts payable workflows, referencing overdue invoices, balance statements, and payment requests targeting real vendors and internal stakeholders." +type: "rule" +severity: "high" +source: | + type.inbound + and any(filter(body.previous_threads, + // single recipient in the previous thread + length(.recipients.to) == 1 + and length(.recipients.cc) == 0 + // contains spaces around the colons of the "headers" + and strings.count(.preamble, ' : ') >= 2 + and regex.icount(.preamble, '(?m)^\s*[a-z]+ +: +\S') == regex.icount(.preamble, + '(?m)^.' + ) + ), + // the previous thread with the goofy spaces + // includes a VIP as a recipeint + any(map(filter(.recipients.to, + // via email + .email.email != "" + and any($org_vips, + strings.icontains(..email.email, .email) + or strings.icontains(..display_name, + .display_name + ) + ) + ), + .email.email + ), + // email is not in the "live" messages + not strings.icontains(sender.email.email, .) + and not any(recipients.to, strings.icontains(.email.email, ..)) + and not any(recipients.cc, strings.icontains(.email.email, ..)) + ) + or any(map(filter(.recipients.to, + // via display_name + .email.email == "" + and any($org_vips, + strings.icontains(..display_name, + .display_name + ) + ) + ), + .display_name + ), + // display name is not in the "live" messages + not any(recipients.to, .display_name == ..) + and not any(recipients.cc, .display_name == ..) + and sender.display_name != . + ) + ) +attack_types: + - "BEC/Fraud" +tactics_and_techniques: + - "Impersonation: VIP" + - "Social engineering" + - "Evasion" + - "Spoofing" +detection_methods: + - "Content analysis" + - "Header analysis" + - "Sender analysis" From e2cb3d334d6bb4ddfce35e1a1ded0bf3de34c860 Mon Sep 17 00:00:00 2001 From: CI Bot Date: Sat, 4 Jul 2026 20:04:11 +0000 Subject: [PATCH 2/4] Auto-format MQL and add rule IDs --- detection-rules/vip_impersonation_prev_thread_space_colon.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/vip_impersonation_prev_thread_space_colon.yml b/detection-rules/vip_impersonation_prev_thread_space_colon.yml index ffadb090ac7..f3cc8f6eeee 100644 --- a/detection-rules/vip_impersonation_prev_thread_space_colon.yml +++ b/detection-rules/vip_impersonation_prev_thread_space_colon.yml @@ -61,3 +61,4 @@ detection_methods: - "Content analysis" - "Header analysis" - "Sender analysis" +id: "b566ef3c-f5c0-5937-a73a-f33b98e02275" From c876b189913fed276b9e43413abdac63985da42d Mon Sep 17 00:00:00 2001 From: Brandon Murphy <4827852+zoomequipd@users.noreply.github.com> Date: Mon, 6 Jul 2026 17:10:21 -0500 Subject: [PATCH 3/4] Update vip_impersonation_prev_thread_space_colon.yml --- detection-rules/vip_impersonation_prev_thread_space_colon.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detection-rules/vip_impersonation_prev_thread_space_colon.yml b/detection-rules/vip_impersonation_prev_thread_space_colon.yml index f3cc8f6eeee..67f682c9202 100644 --- a/detection-rules/vip_impersonation_prev_thread_space_colon.yml +++ b/detection-rules/vip_impersonation_prev_thread_space_colon.yml @@ -1,4 +1,4 @@ -name: "VIP Impersonation: Fabricated thread history with fake VIP recipients" +name: "VIP impersonation: Fabricated thread history with fake VIP recipients" description: "Detects inbound messages that contain forged prior thread histories where the fake headers use abnormal spacing around colons - a hallmark of programmatically generated preambles. The fabricated threads reference VIP recipients from the organization who are absent from the live message's actual recipients, suggesting the thread was constructed to manufacture legitimacy. Observed messages impersonate finance or accounts payable workflows, referencing overdue invoices, balance statements, and payment requests targeting real vendors and internal stakeholders." type: "rule" severity: "high" From f463e54ca156bfc5b92dc8eb27c096d1a1942338 Mon Sep 17 00:00:00 2001 From: Brandon Murphy <4827852+zoomequipd@users.noreply.github.com> Date: Wed, 8 Jul 2026 14:12:30 -0500 Subject: [PATCH 4/4] Update vip_impersonation_prev_thread_space_colon.yml --- detection-rules/vip_impersonation_prev_thread_space_colon.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detection-rules/vip_impersonation_prev_thread_space_colon.yml b/detection-rules/vip_impersonation_prev_thread_space_colon.yml index 67f682c9202..1d80cf5ddcd 100644 --- a/detection-rules/vip_impersonation_prev_thread_space_colon.yml +++ b/detection-rules/vip_impersonation_prev_thread_space_colon.yml @@ -15,7 +15,7 @@ source: | ) ), // the previous thread with the goofy spaces - // includes a VIP as a recipeint + // includes a VIP as a recipient any(map(filter(.recipients.to, // via email .email.email != ""