Reconnaissance: Fake real estate inquiry with empty body

 1name: "Reconnaissance: Fake real estate inquiry with empty body"
 2description: "Detects inbound messages with no body content — neither plain text nor HTML — but an unusually long subject line containing real estate inquiry language. The subject lines impersonate prospective home buyers asking about specific property listings or seeking a trusted local real estate agent, often mentioning relocation. These messages are designed to establish contact with real estate professionals as a precursor to fraud."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    body.plain.raw is null
 9    or body.plain.raw == ""
10    or regex.imatch(body.plain.raw, '^\s*$')
11  )
12  and (
13    body.html.raw is null
14    or body.html.raw == ""
15    or regex.imatch(body.html.raw, '^\s*$')
16  )
17  and length(subject.base) > 150
18  and (
19    strings.icontains(subject.base, 'purchase a home')
20    or regex.icontains(subject.base,
21                       'the listing (?:on|at)',
22                       '(?:interested in|regarding) (?:this|the) property',
23                       '(?:will be|are) relocating'
24    )
25  )  
26attack_types:
27  - "BEC/Fraud"
28tactics_and_techniques:
29  - "Social engineering"
30detection_methods:
31  - "Content analysis"
32  - "Sender analysis"
33id: "1f477050-7558-5fdc-859c-9c8ca9bddae5"