Job scam (unsolicited sender)
Detects job scam attempts by analyzing the message body text from an unsolicited sender.
Sublime rule (View on GitHub)
1name: "Job scam (unsolicited sender)"
2description: |
3 Detects job scam attempts by analyzing the message body text from an unsolicited sender.
4type: "rule"
5severity: "low"
6source: |
7 type.inbound
8 and (
9 any(ml.nlu_classifier(body.current_thread.text).intents,
10 .name in ("job_scam") and .confidence == "high"
11 )
12 )
13 and (
14 any(ml.nlu_classifier(body.current_thread.text).entities,
15 .name == "financial"
16 )
17 or strings.icontains(body.current_thread.text, "salary package")
18 or strings.icontains(body.current_thread.text, "kindly")
19 or (
20 any(ml.nlu_classifier(body.current_thread.text).entities,
21 .name in ("greeting", "salutation")
22 )
23 and (
24 (
25 length(recipients.to) == 0
26 or length(recipients.bcc) > 0
27 or (
28 all(recipients.to, .email.domain.valid == false)
29 and all(recipients.cc, .email.domain.valid == false)
30 )
31 )
32 )
33 )
34 )
35 // negating income / job verification senders
36 and not (
37 sender.email.domain.root_domain in ('loandepot.com', 'sofi.com')
38 and headers.auth_summary.dmarc.pass
39 )
40 and (
41 not profile.by_sender().solicited
42 or profile.by_sender().any_messages_malicious_or_spam
43 )
44 and not profile.by_sender().any_messages_benign
45attack_types:
46 - "BEC/Fraud"
47tactics_and_techniques:
48 - "Social engineering"
49detection_methods:
50 - "Content analysis"
51 - "Header analysis"
52 - "Natural Language Understanding"
53 - "Sender analysis"
54id: "a37dc32d-33a4-5097-a585-ff6c345d0ecc"