Message content: Request for author engagement

 1name: "Message content: Request for author engagement"
 2description: "Detects inbound messages containing language consistent with unsolicited book/author related scam from a free email provider. Often used to ask for payment related to promotion of an upcoming or recently published book."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // freemailer
 8  and sender.email.domain.root_domain in $free_email_providers
 9  // goodreads mention
10  and strings.icontains(body.current_thread.text, "goodreads")
11  // addresses the recipient as the author of their own work
12  and regex.icontains(body.current_thread.text,
13                      '\byour (?:books?|work|text|title|novel|manuscript|writing|scholarship|research|reporting|story)\b'
14  )
15  //
16  and regex.icontains(body.current_thread.text,
17                      '\b(?:featur|spotlight|showcase|introduce your|invite you|selected your|reading (?:cycle|circle|challenge|community|discussion))'
18  )
19  // negate highly trusted sender domains unless they fail DMARC authentication
20  and not (
21    sender.email.domain.root_domain in $high_trust_sender_root_domains
22    and coalesce(headers.auth_summary.dmarc.pass, false)
23  )  
24attack_types:
25  - "Spam"
26tactics_and_techniques:
27  - "Social engineering"
28detection_methods:
29  - "Content analysis"
30id: "c52f5f19-0928-59bf-8409-d58df640c5a7"