BEC/Fraud: B2B sales inquiry cold outreach lure

calendar Sep 24, 2026  ·
Share on: linkedin copy

Detects inbound plain-text messages that mimic sales inquiries or project discussion requests, using language referencing sales teams, project requirements, and procurement officers to establish false business legitimacy. An NLU classifier confirms the message content aligns with B2B cold outreach or purchase order themes, a common pretext used to initiate contact before pivoting to fraudulent business proposals or follow-on scams.

Sublime rule (View on GitHub)

 1name: "BEC/Fraud: B2B sales inquiry cold outreach lure"
 2description: "Detects inbound plain-text messages that mimic sales inquiries or project discussion requests, using language referencing sales teams, project requirements, and procurement officers to establish false business legitimacy. An NLU classifier confirms the message content aligns with B2B cold outreach or purchase order themes, a common pretext used to initiate contact before pivoting to fraudulent business proposals or follow-on scams."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and body.html.raw is null
 8  and strings.icontains(subject.base, 'sales inquiry', 'project discussion')
 9  and strings.icontains(body.current_thread.text,
10                        'sales team',
11                        'project and requirements',
12                        'chief procurement officer',
13  )
14  and any(ml.nlu_classifier(body.current_thread.text).topics,
15          .name in ("B2B Cold Outreach", "Purchase Orders")
16          and .confidence != "low"
17  )  
18attack_types:
19  - "BEC/Fraud"
20  - "Spam"
21tactics_and_techniques:
22  - "Social engineering"
23detection_methods:
24  - "Content analysis"
25  - "Natural Language Understanding"
26id: "9e8b2c52-cd9b-5bd2-b204-282f3430ade2"
to-top