Body: AI-generated invoice template artifacts

 1name: "Body: AI-generated invoice template artifacts"
 2description: "Flags inbound messages where NLU classification of the thread text indicates medium or high confidence credential theft or BEC intent, and the message HTML contains comment artifacts characteristic of AI-generated invoice/billing templates (e.g. 'PDF icon', 'File row', 'Billing Table', 'CTA Button'). Messages from highly trusted sender domains are excluded unless they fail DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(ml.nlu_classifier(body.current_thread.text).intents,
 8          .name in ("cred_theft", "bec") and .confidence in ("medium", "high")
 9  )
10  // templated ai-generated comments
11  and any(html.xpath(body.html, '//comment()').nodes,
12          regex.icontains(.raw,
13                          'PDF icon|File row|Status \+ Reference|Billing Table|Invoice Info|CTA Button'
14          )
15  )
16  // negate highly trusted sender domains unless they fail DMARC authentication
17  and not (
18    sender.email.domain.root_domain in $high_trust_sender_root_domains
19    and coalesce(headers.auth_summary.dmarc.pass, false)
20  )  
21tags:
22 - "Attack surface reduction"
23attack_types:
24  - "Credential Phishing"
25  - "BEC/Fraud"
26tactics_and_techniques:
27  - "Social engineering"
28  - "Spoofing"
29detection_methods:
30  - "Natural Language Understanding"
31  - "HTML analysis"
32  - "Header analysis"
33  - "Sender analysis"
34id: "52b593a9-e051-5c80-85ac-ca9da0e215c9"