BEC: Financial fraud from newly registered sender domain

 1name: "BEC: Financial fraud from newly registered sender domain"
 2description: "Detects inbound messages from newly registered domains that exhibit business email compromise intent with high-confidence financial or payment topics. The message must also contain explicit banking details such as account and routing numbers, invoice references, or payment urgency language, and must either fail DMARC on a trusted domain or originate from an untrusted domain."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    network.whois(sender.email.domain).days_old < 30
 9    or (
10      network.whois(sender.email.domain).days_old < 180
11      and (
12        regex.icontains(body.current_thread.text,
13                        'invoice\s+#[A-Z]{2,}(?:-\d+){1,2}'
14        )
15        or strings.icontains(subject.base, 'annuity financial')
16      )
17    )
18  )
19  and any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")
20  and (
21    any(ml.nlu_classifier(body.current_thread.text).topics,
22        .name in ("Financial Communications", "Payment Information")
23        and .confidence == "high"
24    )
25  )
26  and (
27    (
28      regex.icontains(body.current_thread.text,
29                      'account\s*(?:number|num|no\.?)\s*:?\s*\d{5,}'
30      )
31      and regex.icontains(body.current_thread.text,
32                          '(?:wire\s*)?routing\s*(?:number|num|no\.?)\s*:?\s*\d{5,}'
33      )
34    )
35    or regex.icontains(body.current_thread.text,
36                       'invoice\s*(?:#|number|num|no\.?)\s*:?\s*[A-Z0-9-]{3,}',
37                       'per\s+\w+.{0,5}s\s+request'
38    )
39    or strings.icontains(body.current_thread.text,
40                         'due upon receipt',
41                         'confirm receipt of invoice',
42                         'see attached invoice'
43    )
44  )
45  // negate highly trusted sender domains unless they fail DMARC authentication
46  and not (
47    sender.email.domain.root_domain in $high_trust_sender_root_domains
48    and coalesce(headers.auth_summary.dmarc.pass, false)
49  )  
50attack_types:
51  - "BEC/Fraud"
52tactics_and_techniques:
53  - "Social engineering"
54  - "Spoofing"
55detection_methods:
56  - "Natural Language Understanding"
57  - "Whois"
58  - "Content analysis"
59  - "Sender analysis"
60  - "Header analysis"
61id: "4be9b165-975f-5587-b780-9441d1b30782"