[Shared Samples] [PR #4497] added rule: PR# 4497 - Headers: X-Source-Auth mismatch with sender address

Author: github-actions[bot]

detection-rules/4497_headers_x_source_auth_sender_mismatch.yml

@@ -0,0 +1,31 @@
+name: "PR# 4497 - Headers: X-Source-Auth mismatch with sender address"
+description: "Detects messages where the X-Source-Auth header contains a different email address than the sender, indicating potential spoofing or mismatched authentication."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  // X-Source-Auth doesn't match sender
+  and any(headers.hops,
+          any(.fields,
+              .name == 'X-Source-Auth'
+              and .value != sender.email.email
+              and strings.parse_email(.value).email is not null
+          )
+  )
+tags:
+  - "Attack surface reduction"
+  - pr_author_D-Bolton
+  - created_from_open_prs
+  - rule_status_added
+attack_types:
+  - "BEC/Fraud"
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Spoofing"
+  - "Evasion"
+detection_methods:
+  - "Header analysis"
+  - "Sender analysis"
+id: "cc2ac8a8-db8b-5c20-a04c-427908ffd1e4"
+references:
+  - https://github.com/sublime-security/sublime-rules/pull/4497