Detection rules › Sublime MQL
Impersonation: Australian Federal Police with criminal case language
Detects messages impersonating the Australian Federal Police using law enforcement terminology in the subject and sender display name, combined with official correspondence language including case references, investigation details, and compliance demands.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Extortion |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| subject |
| type |
Rule body MQL
type.inbound
and (
strings.ilike(subject.base, '*afp*')
or strings.ilike(subject.base, '*australian federal police*')
)
and (
2 of (
strings.ilike(subject.base, '*case*'),
strings.ilike(subject.base, '*investigation*'),
strings.ilike(subject.base, '*law enforcement*'),
strings.ilike(subject.base, '*management*'),
strings.ilike(subject.base, '*notice*'),
strings.ilike(subject.base, '*reference*')
)
)
and (
regex.icontains(body.current_thread.text, 'investigation|correspondence')
and regex.icontains(body.current_thread.text, 'case (?:reference|type)')
)
Detection logic
Scope: inbound message.
Detects messages impersonating the Australian Federal Police using law enforcement terminology in the subject and sender display name, combined with official correspondence language including case references, investigation details, and compliance demands.
- inbound message
any of:
- subject.base matches '*afp*'
- subject.base matches '*australian federal police*'
at least 2 of 6: subject.base matches any of 6 patterns
*case**investigation**law enforcement**management**notice**reference*
all of:
- body.current_thread.text matches 'investigation|correspondence'
- body.current_thread.text matches 'case (?:reference|type)'
Inspects: body.current_thread.text, subject.base, type.inbound. Sensors: regex.icontains, strings.ilike.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *afp* |
strings.ilike | substring | *australian federal police* |
strings.ilike | substring | *case* |
strings.ilike | substring | *investigation* |
strings.ilike | substring | *law enforcement* |
strings.ilike | substring | *management* |
strings.ilike | substring | *notice* |
strings.ilike | substring | *reference* |
regex.icontains | regex | investigation|correspondence |
regex.icontains | regex | case (?:reference|type) |