Job scam with specific salary pattern

 1name: "Job scam with specific salary pattern"
 2description: "Detects job scam content that includes specific weekly salary mentions (e.g., '$XXX weekly' patterns) in either the current email thread or previous thread conversations, while excluding legitimate income verification services."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      // job scam in current thread
10      any(ml.nlu_classifier(body.current_thread.text).intents,
11          .name in ("job_scam") and .confidence != "low"
12      )
13      // and salary mention in current thread
14      and regex.icontains(body.current_thread.text,
15                          '\$\d{3} weekly',
16                          'week \$\d{3}',
17                          'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
18      )
19    )
20    // job scam in previous thread
21    or any(body.previous_threads,
22           any(ml.nlu_classifier(.text).intents,
23               .name in ("job_scam") and .confidence != "low"
24           )
25           // and salary mention in previous thread
26           and regex.icontains(.text,
27                               '\$\d{3} weekly',
28                               'week \$\d{3}',
29                               'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
30           )
31    )
32    // job scam lure delivered as a PDF with an empty email body
33    or (
34      length(body.current_thread.text) == 0
35      and length(attachments) == 1
36      and any(filter(attachments, .file_type == "pdf"),
37              any(file.explode(.),
38                  // specific weekly salary pattern in the OCR
39                  regex.icontains(.scan.ocr.raw,
40                                  '\$\d{3} week',
41                                  'week \$\d{3}',
42                                  'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
43                  )
44                  and regex.icontains(.scan.ocr.raw,
45                                      'fully remote',
46                                      'remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)',
47                                      'remotely',
48                                      'work[\s-]?from[\s-]?home',
49                                      'equal opportunity employer',
50                                      'how to apply',
51                                      'submit (?:your )?application',
52                                      'remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)',
53                                      'remotely',
54                                      'work[\s-]?from[\s-]?home',
55                                      'equal opportunity employer',
56                                      'how to apply',
57                                      'submit (?:your )?application',
58                                      'open to all (?:majors|backgrounds|students)',
59                                      'employment opportunity',
60                                      '\bhiring\b'
61                  )
62                  and not regex.icontains(.scan.ocr.raw,
63                                          'unemployment',
64                                          'monetary (?:re)?determination',
65                                          'weekly benefit amount',
66                                          'supplemental unemployment',
67                                          'work search activit'
68                  )
69              )
70      )
71    )
72  )
73  and length(body.current_thread.links) < 10
74  
75  // negating income / job verification senders
76  and not (
77    sender.email.domain.root_domain in (
78      'loandepot.com',
79      'sofi.com',
80      'lensa.com',
81      'indeed.com',
82      'ziprecruiter.com',
83      'glassdoor.com',
84      'postjobfree.com',
85      'jobplacements.com'
86    )
87    and headers.auth_summary.dmarc.pass
88  )  
89attack_types:
90  - "BEC/Fraud"
91tactics_and_techniques:
92  - "Social engineering"
93detection_methods:
94  - "Content analysis"
95  - "Natural Language Understanding"
96  - "Header analysis"
97  - "Sender analysis"
98id: "af7f9e21-54a1-5bba-a70d-e4d52a13eae3"