Link: Fake RFP/bid reference number lure

 1name: "Link: Fake RFP/bid reference number lure"
 2description: "Flags inbound messages that reference an RFP, RFQ, bid, or proposal-style tracking code (e.g. REF-XXXX-XXXX) within a reply thread, where the embedded link points to a domain that differs from the sender's domain. This pattern is common in lures impersonating procurement, tender, or vendor bid notifications to drive recipients to an external link, and excludes messages from designated high-trust domains that pass DMARC."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(body.current_thread.links,
 8                 regex.icontains(.display_text,
 9                                 '(?:REF|S?RF[PQI]|BID|PROP)(?:-(?:[A-Z][0-9][A-Z][0-9]|[A-Z]{2}[0-9]{2})){2}'
10                 )
11          ),
12          .href_url.domain.root_domain != sender.email.domain.root_domain
13  )
14  and not (
15    sender.email.domain.root_domain in $high_trust_sender_root_domains
16    and coalesce(headers.auth_summary.dmarc.pass, false)
17  )  
18attack_types:
19  - "Credential Phishing"
20  - "BEC/Fraud"
21  - "Spam"
22tactics_and_techniques:
23  - "Social engineering"
24  - "Impersonation: Brand"
25  - "Spoofing"
26detection_methods:
27  - "Content analysis"
28  - "URL analysis"
29  - "Header analysis"
30  - "Sender analysis"
31id: "15f106d7-1d28-5233-b428-50c537744735"