Attachment: Embedded MSG file with payment lure and newly registered domain

calendar Sep 25, 2026  ·
Share on: linkedin copy

Detects inbound messages carrying an .msg attachment that itself contains an embedded email. The nested message combines financial fraud language—references to ACH/wire transfers, invoices, remittance, or urgency-based payment discounts—with a link to a domain registered within the last 30 days, a pattern consistent with business email compromise or invoice fraud schemes hiding their payload inside a forwarded or attached message to evade detection.

Sublime rule (View on GitHub)

 1name: "Attachment: Embedded MSG file with payment lure and newly registered domain"
 2description: "Detects inbound messages carrying an .msg attachment that itself contains an embedded email. The nested message combines financial fraud language—references to ACH/wire transfers, invoices, remittance, or urgency-based payment discounts—with a link to a domain registered within the last 30 days, a pattern consistent with business email compromise or invoice fraud schemes hiding their payload inside a forwarded or attached message to evade detection."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_extension =~ "msg"),
 8          any(file.explode(.),
 9              // payment request inside the embedded message
10              2 of (
11                regex.icontains(.scan.strings.raw,
12                                '\b(?:ach|wire transfer|remit(?:ted|tance)?)\b'
13                ),
14                strings.icontains(.scan.strings.raw, 'invoice'),
15                regex.icontains(.scan.strings.raw,
16                                'payment discount|keep the discount|by (?:today|tomorrow|end of (the )?day)'
17                ),
18                any(ml.nlu_classifier(.scan.strings.raw).topics,
19                    .name == 'Request to View Invoice'
20                )
21              )
22              // newly registered domain referenced in the embedded message
23              and any(.scan.url.urls, network.whois(.domain).days_old < 30)
24          )
25  )  
26attack_types:
27  - "BEC/Fraud"
28tactics_and_techniques:
29  - "Social engineering"
30  - "Evasion"
31detection_methods:
32  - "File analysis"
33  - "Content analysis"
34  - "URL analysis"
35  - "Whois"
36  - "Natural Language Understanding"
37id: "fa7b121f-7f91-515a-9912-1e50398730db"
to-top