BEC: Executive coaching vendor impersonation

 1name: "BEC: Executive coaching vendor impersonation"
 2description: "Detects fraudulent messages impersonating leadership development coaching services. The rule identifies inbound messages referencing coaching and executive services terminology alongside financial indicators such as invoices and W-9 forms. Natural language understanding is used to confirm high-confidence financial communication intent and BEC signals."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    strings.icontains(body.current_thread.text, "ezra", "hesion")
 9    or regex.icontains(body.current_thread.text, 'better\s?up', 'coach\s?hub')
10  )
11  and strings.icontains(strings.replace_confusables(body.current_thread.text),
12                        'leadership development coach',
13                        'coaching, leadership development',
14                        'accounting & collections department',
15                        'executive coach for emerging leaders',
16                        'accounts receivable - coaching division'
17  )
18  and any(ml.nlu_classifier(body.current_thread.text).topics,
19          .name in (
20            "Financial Communications",
21            "Payment Information",
22            "Request to View Invoice"
23          )
24          and .confidence == "high"
25  )
26  and any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")  
27attack_types:
28  - "BEC/Fraud"
29tactics_and_techniques:
30  - "Impersonation: Brand"
31  - "Social engineering"
32detection_methods:
33  - "Content analysis"
34  - "HTML analysis"
35  - "Natural Language Understanding"
36id: "e9223f0f-6b74-5d26-a7ed-90cfa0a36d99"