High Severity

VIP impersonation: Payment handoff with VIP display name authored fake threads

Description

Detects inbound messages where an external sender, absent from the original conversation, targets a single internal recipient after a VIP previously instructed that party to handle invoice or payment correspondence. The rule identifies prior threads where a known VIP explicitly redirected billing or payment contact to an internal address — using language such as forwarding instructions, accounts payable references, or billing handoff phrasing — and flags follow-up messages from external senders who are no longer accompanied by the VIP. NLU classifiers confirm financial context in the prior thread. This pattern is consistent with adversaries monitoring or fabricating invoice-related threads to insert themselves at the point of payment handoff.

References

No references.

Sublime Security
Created Jul 13th, 2026 • Last updated Jul 13th, 2026
Source
type.inbound
and any(map(filter(body.previous_threads,
                   .sender.email.email == ""
                   and .sender.display_name != ""
                   and any($org_vips,
                           strings.icontains(..sender.display_name,
                                             .display_name
                           )
                   )
                   and not coalesce(.subject.is_auto_reply, false)
                   and any(recipients.to,
                           .email.domain.root_domain in $org_domains
                           and strings.icontains(..text, .email.email)
                   )
                   and regex.icontains(.text,
                                       'accounts? payable',
                                       '(?:forward|send|rout|direct|remit|submit|issue) (?:it|a copy) (?:directly )?to',
                                       '(?:forward|send|direct|remit|submit|route) (?:the |all |related )?(?:invoice|correspondence|payment|billing)',
                                       'for payment processing,? please contact',
                                       '(?:please )?direct (?:it|all|the)[^\n]{0,60}\bto\b',
                                       'directed to (?:our |the )?[^\n]{0,40}(?:team|processing)',
                                       '(?:as follows|provided below|find below|details are|contact is)[^\n]{0,10}:',
                                       'billing (?:contact|correspondence|team|department|statements?)'
                   )
            ),
            .sender.display_name
        ),
        . != ""
        and any(filter(body.previous_threads, .sender.display_name == ..),
                any(ml.nlu_classifier(.text, subject=.subject.base).tags,
                    .name in ("invoice", "payment") and .confidence != "low"
                )
                or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
                       .name in (
                         "Request to View Invoice",
                         "Payment Information"
                       )
                       and .confidence != "low"
                )
        )
        and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
                    any($org_vips,
                        strings.icontains(..., .display_name)
                        and .email != ""
                        and strings.icontains(..email.email, .email)
                    )
        )
)
and length(filter(flatten([recipients.to, recipients.cc, recipients.bcc]),
                  .email.domain.root_domain in $org_domains
           )
) == 1
and not (
  sender.email.domain.root_domain in $org_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started