[Test Rules] [PR #4515] added rule: VIP impersonation: Fake thread with display name match, email mismatch

Author: github-actions[bot]

detection-rules/4515_vip_impersonation_fake_thread.yml

@@ -0,0 +1,90 @@
+name: "VIP impersonation: Fake thread with display name match, email mismatch"
+description: "This rule is intended to detect fake threads that are impersonating a VIP. It looks for a matching $org_vips display name and checks the email address following it does not match what is in the $org_vips list."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and any($org_vips,
+          (
+            strings.icontains(body.html.display_text,
+                              strings.concat("From: ", .display_name, " <")
+            )
+            or strings.icontains(body.html.display_text,
+                                 strings.concat("From: ",
+                                                strings.concat(.first_name,
+                                                               " ",
+                                                               .last_name
+                                                ),
+                                                " <"
+                                 )
+            )
+            or strings.icontains(body.html.display_text,
+                                 strings.concat("From: ",
+                                                strings.concat(.last_name,
+                                                               ", ",
+                                                               .first_name
+                                                ),
+                                                " <"
+                                 )
+            )
+          )
+          and not (
+            strings.icontains(body.html.display_text,
+                              strings.concat("From: ",
+                                             .display_name,
+                                             " <",
+                                             .email,
+                                             ">"
+                              )
+            )
+            or strings.icontains(body.html.display_text,
+                                 strings.concat("From: ",
+                                                strings.concat(.first_name,
+                                                               " ",
+                                                               .last_name
+                                                ),
+                                                " <",
+                                                .email,
+                                                ">"
+                                 )
+            )
+            or strings.icontains(body.html.display_text,
+                                 strings.concat("From: ",
+                                                strings.concat(.last_name,
+                                                               ", ",
+                                                               .first_name
+                                                ),
+                                                " <",
+                                                .email,
+                                                ">"
+                                 )
+            )
+          )
+  )
+  and any([body.current_thread.text, body.html.display_text, body.plain.raw],
+          3 of (
+            strings.icontains(., "from:"),
+            strings.icontains(., "to:"),
+            strings.icontains(., "sent:"),
+            strings.icontains(., "date:"),
+            strings.icontains(., "cc:"),
+            strings.icontains(., "subject:")
+          )
+  )
+  and (length(headers.references) == 0 or headers.in_reply_to is null)
+attack_types:
+  - "BEC/Fraud"
+tactics_and_techniques:
+  - "Evasion"
+  - "Impersonation: VIP"
+  - "Social engineering"
+  - "Spoofing"
+detection_methods:
+  - "Content analysis"
+  - "Header analysis"
+  - "Sender analysis"
+  - "Whois"
+id: "a067b4db-294b-5177-ab12-0671ec5c7d63"
+og_id: "11cc3e28-65db-5c7e-9436-9d0a700da971"
+testing_pr: 4515
+testing_sha: 1658ad9fc984cdf4e2a8a85f6af83206ffd6dde1