BEC/Fraud: Meeting excuse paired with reply-via-email request

calendar Oct 28, 2026  ·
Share on: linkedin copy

Flags inbound messages sent from free email provider domains where the sender's text is classified as business email compromise with at least medium confidence, and the message body combines a meeting excuse with a request to respond only by email, a common social engineering pattern used to pressure quick action and avoid phone verification.

Sublime rule (View on GitHub)

 1name: "BEC/Fraud: Meeting excuse paired with reply-via-email request"
 2description: "Flags inbound messages sent from free email provider domains where the sender's text is classified as business email compromise with at least medium confidence, and the message body combines a meeting excuse with a request to respond only by email, a common social engineering pattern used to pressure quick action and avoid phone verification."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // sender is freemail
 8  and sender.email.domain.root_domain in $free_email_providers
 9  and any(ml.nlu_classifier(body.current_thread.text).intents,
10          .name == 'bec' and .confidence != 'low'
11  )
12  and any(ml.nlu_classifier(body.current_thread.text).topics,
13          .name == 'Out of Band Pivot' and .confidence != 'low'
14  )
15  and any(ml.nlu_classifier(body.current_thread.text).entities,
16          .name == 'urgency'
17  )
18  and strings.icontains(body.current_thread.text, 'meeting')
19  and strings.icontains(body.current_thread.text, 'email')
20  // sender display name not in the actual email address local part
21  and not any(regex.iextract(sender.display_name, '\w+'),
22              length(.full_match) > 1
23              and strings.icontains(sender.email.local_part, .full_match)
24  )
25  // at least three random digits
26  and regex.contains(sender.email.local_part, '\d{3}')
27  // no previous threads
28  and length(body.previous_threads) == 0
29  // no links
30  and length(body.links) == 0
31  // no attchments
32  and length(attachments) == 0  
33attack_types:
34  - "BEC/Fraud"
35tactics_and_techniques:
36  - "Free email provider"
37  - "Social engineering"
38detection_methods:
39  - "Natural Language Understanding"
40  - "Content analysis"
41  - "Sender analysis"
42id: "a8e4ffd7-6bfd-55c6-836b-a4187f4d66c2"
to-top