High Severity

Impersonation: Australian Federal Police with criminal case language

Labels

BEC/Fraud

Extortion

Natural Language Understanding

Sender analysis

Description

Detects messages impersonating the Australian Federal Police using law enforcement terminology in the subject and sender display name, combined with official correspondence language including case references, investigation details, and compliance demands.

References

No references.

Sublime Security

Created Jun 4th, 2026 • Last updated Jun 4th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and (
  strings.ilike(subject.base, '*afp*')
  or strings.ilike(subject.base, '*australian federal police*')
)
and (
  2 of (
    strings.ilike(subject.base, '*case*'),
    strings.ilike(subject.base, '*investigation*'),
    strings.ilike(subject.base, '*law enforcement*'),
    strings.ilike(subject.base, '*management*'),
    strings.ilike(subject.base, '*notice*'),
    strings.ilike(subject.base, '*reference*')
  )
)
and (
  regex.icontains(body.current_thread.text, 'investigation|correspondence')
  and regex.icontains(body.current_thread.text, 'case (?:reference|type)')
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.