Job Scam (unsolicited sender)
Detects job scam attempts by analyzing the message body text from an unsolicited sender.
Sublime rule (View on GitHub)
1name: "Job Scam (unsolicited sender)"
2description: |
3 Detects job scam attempts by analyzing the message body text from an unsolicited sender.
4type: "rule"
5severity: "low"
6source: |
7 type.inbound
8 and any(ml.nlu_classifier(body.current_thread.text).intents,
9 .name in ("job_scam")
10 and .confidence == "high"
11 and any(ml.nlu_classifier(body.current_thread.text).entities, .name == "financial")
12 )
13
14 and (
15 not profile.by_sender().solicited
16 or profile.by_sender().any_messages_malicious_or_spam
17 )
18
19 and not profile.by_sender().any_false_positives
20attack_types:
21 - "BEC/Fraud"
22tactics_and_techniques:
23 - "Social engineering"
24detection_methods:
25 - "Content analysis"
26 - "Header analysis"
27 - "Natural Language Understanding"
28 - "Sender analysis"
29id: "a37dc32d-33a4-5097-a585-ff6c345d0ecc"