Attachment: Fake research internship offer

 1name: "Attachment: Fake research internship offer"
 2description: "Detects inbound, non-reply/forward emails referencing research, internship, or fellowship opportunities with weekly stipend language, accompanied by a PDF attachment whose OCR-extracted text confirms a research/internship role, cites a weekly dollar stipend, and directs recipients to respond via personal free-mail addresses, text message, or an alternate email—hallmarks of fraudulent job/internship scams designed to harvest personal information or payment."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and not (subject.is_reply or subject.is_forward)
 8  and any([subject.base, body.current_thread.text],
 9          strings.icontains(.,
10                            'research',
11                            'intern',
12                            'fellowship',
13                            'recruit',
14                            'placement',
15                            'opening',
16                            'opportunit',
17                            'stipend',
18                            'hiring',
19                            'per week',
20                            'weekly'
21          )
22  )
23  and any(filter(attachments, .file_type == "pdf"),
24          any(file.explode(.),
25              regex.icontains(.scan.ocr.raw,
26                              'research (?:intern|assistant|associate|support|role|position|study|fellow|participant)',
27                              '\binternship\b'
28              )
29              and regex.icontains(.scan.ocr.raw,
30                                  '\$\s?\d{2,4}\s*(?:/|per)\s*week',
31                                  '\$\s?\d{2,4}\s+weekly'
32              )
33              and regex.icontains(.scan.ocr.raw,
34                                  '@(?:g[a-z]{0,2}mail|hotmail|outlook|yahoo|aol|icloud|proton(?:mail)?|gmx|zoho|live|msn)\.',
35                                  'email (?:the )?(?:supervising |fellowship )?(?:professor|mentor)',
36                                  '(?:by|via|through) text',
37                                  'send (?:a |an )?text',
38                                  'text (?:you|me|us|back|the professor|the mentor)',
39                                  'reach out[^\n]{0,20}text',
40                                  'alternate email'
41              )
42          )
43  )  
44attack_types:
45  - "BEC/Fraud"
46  - "Spam"
47tactics_and_techniques:
48  - "PDF"
49  - "Social engineering"
50  - "Out of band pivot"
51  - "Free email provider"
52detection_methods:
53  - "Optical Character Recognition"
54  - "Content analysis"
55  - "File analysis"
56id: "4c8e81b8-9a2f-52fd-b25e-95c9123091b9"