Detection rules › Sublime MQL

Impersonation: Australian Federal Police with criminal case language

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages impersonating the Australian Federal Police using law enforcement terminology in the subject and sender display name, combined with official correspondence language including case references, investigation details, and compliance demands.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Extortion
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Rule body MQL

type.inbound
and (
  strings.ilike(subject.base, '*afp*')
  or strings.ilike(subject.base, '*australian federal police*')
)
and (
  2 of (
    strings.ilike(subject.base, '*case*'),
    strings.ilike(subject.base, '*investigation*'),
    strings.ilike(subject.base, '*law enforcement*'),
    strings.ilike(subject.base, '*management*'),
    strings.ilike(subject.base, '*notice*'),
    strings.ilike(subject.base, '*reference*')
  )
)
and (
  regex.icontains(body.current_thread.text, 'investigation|correspondence')
  and regex.icontains(body.current_thread.text, 'case (?:reference|type)')
)

Detection logic

Scope: inbound message.

Detects messages impersonating the Australian Federal Police using law enforcement terminology in the subject and sender display name, combined with official correspondence language including case references, investigation details, and compliance demands.

  1. inbound message
  2. any of:
    • subject.base matches '*afp*'
    • subject.base matches '*australian federal police*'
  3. at least 2 of 6: subject.base matches any of 6 patterns
    • *case*
    • *investigation*
    • *law enforcement*
    • *management*
    • *notice*
    • *reference*
  4. all of:
    • body.current_thread.text matches 'investigation|correspondence'
    • body.current_thread.text matches 'case (?:reference|type)'

Inspects: body.current_thread.text, subject.base, type.inbound. Sensors: regex.icontains, strings.ilike.

Indicators matched (10)

FieldMatchValue
strings.ilikesubstring*afp*
strings.ilikesubstring*australian federal police*
strings.ilikesubstring*case*
strings.ilikesubstring*investigation*
strings.ilikesubstring*law enforcement*
strings.ilikesubstring*management*
strings.ilikesubstring*notice*
strings.ilikesubstring*reference*
regex.icontainsregexinvestigation|correspondence
regex.icontainsregexcase (?:reference|type)