Spam: Large financial amount mention from newly registered sender domain

 1name: "Spam: Large financial amount mention from newly registered sender domain"
 2description: "Detects inbound messages where the sender's domain was registered less than 180 days ago, or where whois data is unavailable and the message body is classified by NLU as B2B cold outreach or charity/non-profit solicitation with non-low confidence. Senders use financial-sounding names and rotate first names and target company names while keeping the subject line structure nearly identical. The outreach is designed to appear as a legitimate investment inquiry to bait a response."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    network.whois(sender.email.domain).days_old < 180
 9    or (
10      network.whois(sender.email.domain).days_old is null
11      and any(ml.nlu_classifier(body.current_thread.text).topics,
12              .name in ("B2B Cold Outreach", "Charity and Non-Profit")
13              and .confidence != "low"
14      )
15    )
16  )
17  and any([body.html.display_text, subject.base],
18          regex.icontains(.,
19                          '\$\d{1,3}\s*(?:m|million)\s*(?:\p{Pd}|to|through)\s*\$\d{1,3}\s*(?:m\b|million)'
20          )
21  )  
22attack_types:
23  - "BEC/Fraud"
24  - "Spam"
25tactics_and_techniques:
26  - "Social engineering"
27detection_methods:
28  - "Content analysis"
29  - "Sender analysis"
30  - "Whois"
31id: "e28e1597-6a89-562e-b1e9-e551c5ac4fdd"