BEC/Fraud: Fake investment outreach from suspicious senders

  1name: "BEC/Fraud: Fake investment outreach from suspicious senders"
  2description: |
  3  Detects unsolicited investment/funding outreach emails from suspicious senders.
  4  Targets mass-mailed spam campaigns offering business funding, capital allocation,
  5  and family office outreach.  
  6type: "rule"
  7severity: "medium"
  8source: |
  9  type.inbound
 10  // subject contains investment language
 11  and (
 12    strings.istarts_with(subject.base,
 13                         'acquisition opportunity',
 14                         'an investment opportunity',
 15                         'business opportunity',
 16                         'investment into',
 17                         'investing in',
 18                         'financing for'
 19    )
 20    or any([subject.base, body.current_thread.text],
 21           regex.icontains(.,
 22                           'family.?office',
 23                           '(?:finding|looking for).{1,15}\b(?:manag(?:ing|ement))?\b.firm'
 24           )
 25    )
 26  )
 27  // financial body content
 28  and (
 29    any(ml.nlu_classifier(body.current_thread.text).topics,
 30        .name == "Financial Communications" and .confidence != "low"
 31    )
 32    or (
 33      any(ml.nlu_classifier(body.current_thread.text).topics,
 34          .name in ("B2B Cold Outreach", "Charity and Non-Profit")
 35          and .confidence != "low"
 36      )
 37      and not any(ml.nlu_classifier(body.current_thread.text).topics,
 38                  .name in ("Contact List Solicitation")
 39      )
 40      and regex.icontains(body.current_thread.text,
 41                          '\d{3}k',
 42                          'capital',
 43                          'family.?office',
 44                          'fee structure',
 45                          'funding',
 46                          'funded in \d+',
 47                          'private equity',
 48                          'rates from \d+%'
 49      )
 50    )
 51  )
 52  // suspicious sender
 53  and (
 54    (
 55      sender.email.domain.tld in $suspicious_tlds
 56      or sender.email.domain.tld in ("info", "de")
 57      // freemailer
 58      or sender.email.domain.domain in $free_email_providers
 59      // new sender domain
 60      or network.whois(sender.email.domain).days_old <= 180
 61      // sender mismatch sent via amazonses
 62      or (
 63        headers.return_path.email is not null
 64        and headers.return_path.email != sender.email.email
 65        and headers.return_path.domain.root_domain != sender.email.domain.root_domain
 66        and headers.return_path.domain.root_domain == "amazonses.com"
 67      )
 68    )
 69  
 70    // sender profiles
 71    or (
 72      (
 73        profile.by_sender_email().prevalence == "new"
 74        and not profile.by_sender_email().solicited
 75      )
 76      or (
 77        profile.by_sender_email().any_messages_malicious_or_spam
 78        and not profile.by_sender_email().any_messages_benign
 79      )
 80    )
 81  )
 82  
 83  // negate mailers with unsubscribe links
 84  and not (
 85    any(headers.hops, any(.fields, .name =~ "List-Unsubscribe"))
 86    or any(body.current_thread.links,
 87           strings.icontains(.display_text, "unsubscribe")
 88    )
 89  )  
 90tags:
 91 - "Attack surface reduction"
 92attack_types:
 93  - "BEC/Fraud"
 94tactics_and_techniques:
 95  - "Social engineering"
 96detection_methods:
 97  - "Header analysis"
 98  - "Sender analysis"
 99  - "Content analysis"
100  - "Natural Language Understanding"
101  - "Whois"
102id: "5d4c4a15-661c-5fd1-9d5f-1c72c8230be8"