BEC/Fraud: Fake investment outreach from suspicious TLD

 1name: "BEC/Fraud: Fake investment outreach from suspicious TLD"
 2description: |
 3  Detects unsolicited investment/funding outreach emails from suspicious TLDs.
 4  Targets mass-mailed spam campaigns offering business funding, capital allocation,
 5  and family office outreach.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  // subject contains investment language
11  and (
12    strings.istarts_with(subject.base, 'financing for', 'investment into')
13    or strings.icontains(subject.base, "family office")
14  )
15  
16  // financial body content
17  and (
18    any(ml.nlu_classifier(body.current_thread.text).topics,
19        .name == "Financial Communications" and .confidence != "low"
20    )
21    or (
22      any(ml.nlu_classifier(body.current_thread.text).topics,
23          .name == "B2B Cold Outreach" and .confidence != "low"
24      )
25      and regex.icontains(body.current_thread.text,
26                          'funding',
27                          'capital',
28                          '\d{3}k',
29                          'rates from \d+%',
30                          'funded in \d+',
31                          'family office'
32      )
33    )
34  )
35  
36  // suspicious sender
37  and (
38    sender.email.domain.tld in $suspicious_tlds
39    or sender.email.domain.tld == "info"
40  )  
41
42tags:
43 - "Attack surface reduction"
44attack_types:
45  - "BEC/Fraud"
46tactics_and_techniques:
47  - "Social engineering"
48detection_methods:
49  - "Header analysis"
50  - "Sender analysis"
51  - "Content analysis"
52  - "Natural Language Understanding"
53id: "5d4c4a15-661c-5fd1-9d5f-1c72c8230be8"