Link: Gmail confidential mode message with job scam subject

 1name: "Link: Gmail confidential mode message with job scam subject"
 2description: "Detects Gmail confidential mode messages where the sender-controlled subject, rendered as the message link text, or the sender address contains job scam or recruitment language."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .href_url.domain.domain == "confidential-mail.google.com"
 9          and strings.istarts_with(.href_url.path, "/msg/")
10  )
11  and (
12    // the sender-controlled subject is rendered as the link text
13    any(filter(body.current_thread.links,
14               .href_url.domain.domain == "confidential-mail.google.com"
15        ),
16        any(ml.nlu_classifier(.display_text).intents,
17            .name == "job_scam" and .confidence in ("medium", "high")
18        )
19        // compensation figures such as "$450K–$900K+"
20        or any(ml.nlu_classifier(.display_text).entities,
21               .name == "financial" and regex.contains(.text, '\d\s*[kKmM]\b')
22        )
23        // recruitment terms in the subject
24        or regex.icontains(.display_text,
25                           '\b(?:leader(?:ship)?|director|mandate|opportunit(?:y|ies)|executive.search|career|jobs?|role)\b'
26        )
27    )
28    // recruitment terms in the sender local part
29    or regex.icontains(sender.email.local_part,
30                       '(?:recruit|talent|staffing|executive.?s[ea]|career)'
31    )
32  )  
33attack_types:
34  - "BEC/Fraud"
35  - "Credential Phishing"
36tactics_and_techniques:
37  - "Evasion"
38  - "Social engineering"
39detection_methods:
40  - "Content analysis"
41  - "Natural Language Understanding"
42  - "Sender analysis"
43  - "URL analysis"
44id: "d27dc9bc-1d01-5b70-aafb-acf18837423f"