BEC: Tax document request

name: "BEC: Tax document request"
description: "Detects messages requesting W-2 tax documents or related tax information that exhibit authentication failures such as DMARC or SPF failures, or mismatched reply-to addresses. The rule identifies senders using common administrative local parts and filters for messages containing W-2 language combined with request entities detected through natural language processing."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // searching for common sender emails
  and sender.email.local_part in~ (
    "contact",
    "no-reply",
    "noreply",
    "info",
    "admin"
  )
  // sender emails unmatched
  and (
    length(headers.reply_to) > 0
    and all(headers.reply_to,
            .email.domain.root_domain != sender.email.domain.root_domain
    )
  )
  // subject lines with words correlating to tax information
  and (
    strings.icontains(subject.base, 'wage')
    or strings.icontains(strings.replace_confusables(subject.base), 'Ŵ-2')
    or regex.icontains(subject.base, 'tax (?:form|state?ment|year)')
    or regex.icontains(subject.base, '\bw-?2?\b')
    or regex.icontains(strings.replace_confusables(subject.base), '\birs\b')
  )
  // body text containing variations of "w2" or "wage statements"
  and (
    (
      strings.icontains(strings.replace_confusables(body.current_thread.text),
                        'Ẇ-2'
      )
      or strings.icontains(body.current_thread.text, "wage statements")
      or regex.icontains(body.current_thread.text, 'w-?2[a-z]?\b')
    )
  )
  // ml classifying for requests
  and any(ml.nlu_classifier(body.current_thread.text).entities,
          .name == "request"
  )
  // exclude legitimate senders or domains
  and not any(ml.nlu_classifier(body.current_thread.text).intents,
              .name == "benign" and .confidence == "high"
  )
  and not (
    sender.email.domain.domain in $org_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
  and not (
    sender.email.domain.root_domain in (
      "excel.com",
      "sharepoint.com",
      "sharepointonline.com",
      "powerpoint.com",
      "onenote.com",
      "microsoft.com",
      "jotform.com",
      "wetrasnfer.com"
    )
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
  // negate highly trusted sender domains unless they fail DMARC authentication
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
  
attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Natural Language Understanding"
  - "Sender analysis"
id: "4834a45e-6d70-5ad9-9043-024eea995e95"