BEC/Fraud: Contract or order lure with mismatched reply-to

calendar Sep 16, 2026  ·
Share on: linkedin copy

Detects inbound messages where the reply-to address differs from the sender's address, while the subject line references a contract agreement or order with an 8-digit numeric identifier and the body text mentions an attached contract or order. This combination is a common tactic in business email compromise attempts designed to redirect replies to an attacker-controlled address.

Sublime rule (View on GitHub)

 1name: "BEC/Fraud: Contract or order lure with mismatched reply-to"
 2description: "Detects inbound messages where the reply-to address differs from the sender's address, while the subject line references a contract agreement or order with an 8-digit numeric identifier and the body text mentions an attached contract or order. This combination is a common tactic in business email compromise attempts designed to redirect replies to an attacker-controlled address."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(headers.reply_to, .email.email != sender.email.email)
 8  and regex.icontains(subject.subject, '(?:contract agreement|order)_\d{8}\b')
 9  and regex.icontains(body.current_thread.text,
10                      'attached (?:contract agreement|order)'
11  )  
12attack_types:
13  - "BEC/Fraud"
14tactics_and_techniques:
15  - "Spoofing"
16  - "Social engineering"
17detection_methods:
18  - "Header analysis"
19  - "Content analysis"
20id: "d5bc416a-9289-5827-a748-2b7f1f31736d"
to-top