This rule detects VIP impersonation in inbound messages by identifying a fabricated prior thread in which a VIP appears as the author, but the quoted header uses an angle-bracketed name where an address should appear (e.g., "Jane Doe<Jane Doe>" or "Jane Doe < Jane Doe >"), or substitutes the organization’s brand name for an address. It requires that the VIP be part of the organization’s VIP set and that the preamble’s header contains a display-name and an inner value extracted via regex. The extracted dn (display name) and inner value are compared case-insensitively against known VIPs and known org brand names; matches can occur in either direction (dn contains inner or inner contains dn). The rule also enforces that the VIP’s real address is not present in the live recipients (To/CC/BCC) to indicate the actor fabricated the thread rather than communicating with the VIP directly. Additionally, it excludes cases where the sender’s domain is the organization’s root domain and DMARC validation passes, reducing false positives. The detection targets inbound mail content and headers, relying on content analysis, header analysis, and sender analysis. It is categorized under BEC/Fraud with tactics and techniques including VIP impersonation, social engineering, and spoofing.