Reconnaissance: Numeric-hex reference code subject

calendar Sep 21, 2026  ·
Share on: linkedin copy

Detects inbound messages whose subject contains a structured reference-code identifier (a hash mark, 8-digit number, hyphen, and 8-character hex string, e.g. #12345678-abcdef12). The official-looking reference number is a response-elicitation tactic to confirm the mailbox is live, monitored, and opening a thread for further social engineering.

Sublime rule (View on GitHub)

 1name: "Reconnaissance: Numeric-hex reference code subject"
 2description: "Detects inbound messages whose subject contains a structured reference-code identifier (a hash mark, 8-digit number, hyphen, and 8-character hex string, e.g. #12345678-abcdef12). The official-looking reference number is a response-elicitation tactic to confirm the mailbox is live, monitored, and opening a thread for further social engineering."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and regex.imatch(subject.base, '#\d{8}-[a-f0-9]{8}\b')  
 8attack_types:
 9  - "BEC/Fraud"
10  - "Spam"
11tactics_and_techniques:
12  - "Social engineering"
13detection_methods:
14  - "Header analysis"
15id: "637ec97a-9ce3-50af-bae2-a2d86e8d19e4"
to-top