Suspicious request for financial information

  1name: "Suspicious request for financial information"
  2description: "Email is from a suspicious sender and contains a request for financial information, such as AR reports."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and length(attachments) <= 1
  8  and length(recipients.to) <= 2
  9  // suspicious sender
 10  and (
 11    (
 12      length(headers.reply_to) > 0
 13      and all(headers.reply_to,
 14              .email.domain.root_domain != sender.email.domain.root_domain
 15              and .email.domain.root_domain not in $org_domains
 16      )
 17    )
 18    or sender.email.domain.root_domain in $free_email_providers
 19    or profile.by_sender().days_known < 3
 20  )
 21  // specific financial language
 22  and (
 23    (
 24      regex.icontains(subject.subject,
 25                      '\b(Aged|Age?ing) (Payables|Receivables|Report)',
 26                      'reconcill?iation (report|statement).*(issued (settlement|advice)s?)|billing records?'
 27      )
 28      or regex.imatch(subject.base, 'outstanding due invoices')
 29    )
 30    or (
 31      regex.icontains(body.current_thread.text,
 32                      '\b(Aged|Age?ing) (?:Collection|Payables|Receivables|Report)',
 33                      '(latest|updated|recent) (\bAR\b|\b\AP\b|\bAR\b \& \bAP\b|accounts?) (?:Aging|Payables|Receivables|Reports)',
 34                      '(shared?|send|forward|provide).*remittance (advice|receipts?|statements?)'
 35      )
 36      or strings.icontains(body.current_thread.text,
 37                           "copy of a current statement",
 38                           "unpaid and due invoices"
 39      )
 40      or (
 41        strings.icontains(body.current_thread.text, "please send all past due")
 42        and strings.icontains(body.current_thread.text, "current invoices")
 43      )
 44      or (
 45        strings.icontains(body.current_thread.text, 'annuity financial')
 46        and any(ml.nlu_classifier(body.current_thread.text).topics,
 47                .name == "Request to View Invoice"
 48        )
 49      )
 50    )
 51    // suspicious link display text
 52    or (
 53      any(body.links,
 54          regex.icontains(.display_text,
 55                          '(Payment|Remittance|Settlement|Transfer) ?Batch'
 56          )
 57      )
 58    )
 59    // suspicious sender display name
 60    or (
 61      regex.icontains(sender.display_name,
 62                      'Accounts? (?:Payable (?:Dep(\.|t\.?|artment)|e?Receipt)|(Co[[:punct:]]?ordinator|Admin|Manager|Payee))'
 63      )
 64      // sender email listed as a recipient or recipients undisclosed/null
 65      and (
 66        (
 67          sender.email.email in map(recipients.to, .email.email)
 68          or (length(recipients.to) == 0 or length(recipients.to) is null)
 69        )
 70        // non-benign nlu intent
 71        or any(ml.nlu_classifier(body.current_thread.text).intents,
 72               .name != "benign"
 73        )
 74      )
 75    )
 76    or (
 77      any(ml.nlu_classifier(body.current_thread.text).intents,
 78          .name == "cred_theft" and .confidence == "high"
 79      )
 80      and any(ml.nlu_classifier(body.current_thread.text).entities,
 81              .name == "financial" and .text =~ "remittance"
 82      )
 83    )
 84  )
 85  // negate resume related/job inquiry outreach
 86  and not (
 87    any(ml.nlu_classifier(body.current_thread.text).topics,
 88        .name == "Professional and Career Development" and .confidence == "high"
 89    )
 90    and any(ml.nlu_classifier(body.current_thread.text).intents,
 91            .name == "benign" and .confidence != "low"
 92    )
 93  )
 94  and not (
 95    sender.email.domain.root_domain in $high_trust_sender_root_domains
 96    and coalesce(headers.auth_summary.dmarc.pass, false)
 97  )
 98  and not profile.by_sender().any_messages_benign  
 99
100attack_types:
101  - "BEC/Fraud"
102tactics_and_techniques:
103  - "Free email provider"
104  - "Impersonation: Employee"
105  - "Impersonation: VIP"
106  - "Social engineering"
107detection_methods:
108  - "Content analysis"
109  - "Header analysis"
110  - "Sender analysis"
111id: "4ebdaa4d-4db2-56c6-9a6c-220ad49b7681"