Social engineering: Document page reference lure

calendar Nov 9, 2026  ·
Share on: linkedin copy

Detects inbound messages containing phrasing that references specific document page numbers, a pattern commonly used to lend false legitimacy to fraudulent requests involving document review or signature.

Sublime rule (View on GitHub)

 1name: "Social engineering: Document page reference lure"
 2description: "Detects inbound messages containing phrasing that references specific document page numbers, a pattern commonly used to lend false legitimacy to fraudulent requests involving document review or signature."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and regex.icontains(body.current_thread.text,
 8                      '\x6f\x6e\x20\x70\x61\x67\x65\x73 \d[a-z] \x61\x6e\x64 \d[a-z]'
 9  )  
10attack_types:
11  - "BEC/Fraud"
12  - "Credential Phishing"
13tactics_and_techniques:
14  - "Social engineering"
15detection_methods:
16  - "Content analysis"
17  - "Threat intelligence"
18id: "c62698eb-aa8d-53b3-8909-07755b0218a9"
to-top