sublimemediumRule

Link: Fake RFP/bid reference number lure

Flags inbound messages that reference an RFP, RFQ, bid, or proposal-style tracking code (e.g. REF-XXXX-XXXX) within a reply thread, where the embedded link points to a domain that differs from the sender's domain. This pattern is common in lures impersonating procurement, tender, or vendor bid notifications to drive recipients to an external link, and excludes messages from designated high-trust domains that pass DMARC.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1598.003

initial-access

Detection Query

type.inbound
and any(filter(body.current_thread.links,
               regex.icontains(.display_text,
                               '(?:REF|S?RF[PQI]|BID|PROP)(?:-(?:[A-Z][0-9][A-Z][0-9]|[A-Z]{2}[0-9]{2})){2}'
               )
        ),
        .href_url.domain.root_domain != sender.email.domain.root_domain
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Fake RFP/bid reference number lure"
description: "Flags inbound messages that reference an RFP, RFQ, bid, or proposal-style tracking code (e.g. REF-XXXX-XXXX) within a reply thread, where the embedded link points to a domain that differs from the sender's domain. This pattern is common in lures impersonating procurement, tender, or vendor bid notifications to drive recipients to an external link, and excludes messages from designated high-trust domains that pass DMARC."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(filter(body.current_thread.links,
                 regex.icontains(.display_text,
                                 '(?:REF|S?RF[PQI]|BID|PROP)(?:-(?:[A-Z][0-9][A-Z][0-9]|[A-Z]{2}[0-9]{2})){2}'
                 )
          ),
          .href_url.domain.root_domain != sender.email.domain.root_domain
  )
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
  - "Spam"
tactics_and_techniques:
  - "Social engineering"
  - "Impersonation: Brand"
  - "Spoofing"
detection_methods:
  - "Content analysis"
  - "URL analysis"
  - "Header analysis"
  - "Sender analysis"
id: "15f106d7-1d28-5233-b428-50c537744735"