BEC: Wealth management lure from newly registered domain

calendar Sep 8, 2026  ·
Share on: linkedin copy

Detects inbound messages sent from domains registered within the last 90 days that reference wealth management, estate planning, or offshore financial themes such as Luxembourg or licensed intermediaries. The rule combine these thematic keyword matches with an NLU classifier that flags advance fee or business email compromise intent, surfacing messages that closely resemble financial fraud or advance-fee scams.

Sublime rule (View on GitHub)

 1name: "BEC: Wealth management lure from newly registered domain"
 2description: "Detects inbound messages sent from domains registered within the last 90 days that reference wealth management, estate planning, or offshore financial themes such as Luxembourg or licensed intermediaries. The rule combine these thematic keyword matches with an NLU classifier that flags advance fee or business email compromise intent, surfacing messages that closely resemble financial fraud or advance-fee scams."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and network.whois(sender.email.domain).days_old < 90
 8  and 2 of (
 9    strings.icontains(body.current_thread.text, "luxembourg"),
10    strings.icontains(body.current_thread.text, "wealth management"),
11    strings.icontains(body.current_thread.text, "estate planning"),
12    strings.icontains(body.current_thread.text, "full disclosure"),
13    strings.icontains(body.current_thread.text, "licensed intermediary")
14  )
15  and any(ml.nlu_classifier(body.current_thread.text).intents,
16          .name in ("advance_fee", "bec") and .confidence != "low"
17  )
18    
19attack_types:
20  - "BEC/Fraud"
21tactics_and_techniques:
22  - "Social engineering"
23detection_methods:
24  - "Whois"
25  - "Content analysis"
26  - "Natural Language Understanding"
27id: "4120e4bc-2bd9-589c-8c99-1089a92137d3"
to-top