Job scam with specific salary pattern

  1name: "Job scam with specific salary pattern"
  2description: "Detects job scam content that includes specific weekly salary mentions (e.g., '$XXX weekly' patterns) in either the current email thread or previous thread conversations, while excluding legitimate income verification services."
  3type: "rule"
  4severity: "low"
  5source: |
  6  type.inbound
  7  and (
  8    ( // job scam in current thread
  9      any(ml.nlu_classifier(body.current_thread.text).intents,
 10          .name in ("job_scam") and .confidence != "low"
 11      )
 12      // and salary mention in current thread
 13      and regex.icontains(body.current_thread.text,
 14                          '\$\d{3} weekly',
 15                          'week \$\d{3}',
 16                          'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
 17      )
 18    )
 19  
 20    // job scam in previous thread
 21    or any(body.previous_threads,
 22           any(ml.nlu_classifier(.text).intents,
 23               .name in ("job_scam") and .confidence != "low"
 24           )
 25           // and salary mention in previous thread
 26           and regex.icontains(.text,
 27                               '\$\d{3} weekly',
 28                               'week \$\d{3}',
 29                               'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
 30           )
 31    )
 32    // job scam lure delivered as a PDF with an empty email body
 33    or (
 34      length(body.current_thread.text) == 0
 35      and length(attachments) == 1
 36      and any(filter(attachments, .file_type == "pdf"),
 37              any(file.explode(.),
 38                  // specific weekly salary pattern in the OCR
 39                  regex.icontains(.scan.ocr.raw,
 40                                  '\$\d{3,}(?:\s+\w+){0,3}\s+week',
 41                                  'week(?:\s+\w+){0,3}\s+\$\d{3,}',
 42                                  'weekly(?:\s+\w+){0,4}\s+\$\d{3}[^\d]'
 43                  )
 44                  and (
 45                    regex.icontains(.scan.ocr.raw,
 46                                    'fully remote',
 47                                    'remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)',
 48                                    'remotely',
 49                                    'work[\s-]?from[\s-]?home',
 50                                    'equal opportunity employer',
 51                                    'how to apply',
 52                                    'submit (?:your )?application',
 53                                    'remote\b[\s-]*(?:work|position|role|job|employee|worker|assistant|opportunit)',
 54                                    'remotely',
 55                                    'work[\s-]?from[\s-]?home',
 56                                    'equal opportunity employer',
 57                                    'how to apply',
 58                                    'submit (?:your )?application',
 59                                    'open to all (?:majors|backgrounds|students)',
 60                                    'employment opportunity',
 61                                    '\bhiring\b'
 62                    )
 63                    or any(ml.nlu_classifier(.scan.ocr.raw).intents,
 64                           .name in ("job_scam") and .confidence != "low"
 65                    )
 66                  )
 67                  and not regex.icontains(.scan.ocr.raw,
 68                                          'unemployment',
 69                                          'monetary (?:re)?determination',
 70                                          'weekly benefit amount',
 71                                          'supplemental unemployment',
 72                                          'work search activit'
 73                  )
 74              )
 75      )
 76    )
 77  )
 78  and length(body.current_thread.links) < 10
 79  
 80  // negating income / job verification senders
 81  and not (
 82    sender.email.domain.root_domain in (
 83      'loandepot.com',
 84      'sofi.com',
 85      'lensa.com',
 86      'indeed.com',
 87      'ziprecruiter.com',
 88      'glassdoor.com',
 89      'postjobfree.com',
 90      'jobplacements.com'
 91    )
 92    and headers.auth_summary.dmarc.pass
 93  )  
 94attack_types:
 95  - "BEC/Fraud"
 96tactics_and_techniques:
 97  - "Social engineering"
 98detection_methods:
 99  - "Content analysis"
100  - "Natural Language Understanding"
101  - "Header analysis"
102  - "Sender analysis"
103id: "af7f9e21-54a1-5bba-a70d-e4d52a13eae3"