Credential Phishing: Bitcoin portfolio confirmation

name: "Credential Phishing: Bitcoin portfolio confirmation"
description: "Detects inbound messages that combine bitcoin/BTC terminology with portfolio or balance confirmation language, alongside at least two credential-harvesting indicators such as references to a web portal, customer ID, or password. The rule further requires the NLU classifier to flag the message with credential theft, advance fee, or BEC intent, and excludes messages from senders on high trust root domains that pass DMARC authentication."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    strings.icontains(body.current_thread.text, "btc", "bitcoin")
    or regex.icontains(body.current_thread.text, 'pass[\s-]?word')
  )
  and 2 of (
    strings.icontains(body.current_thread.text, "portfolio"),
    strings.icontains(body.current_thread.text, "confirm your balance"),
    strings.icontains(body.current_thread.text, "web portal"),
    strings.icontains(body.current_thread.text, "customer id"),
    strings.icontains(body.current_thread.text, "login to confirm")
  )
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name in ("cred_theft", "advance_fee", "bec")
  )
  // and the sender is not from high trust sender root domains
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Natural Language Understanding"
  - "Header analysis"
id: "64920d24-04c8-5afc-9f99-2948142a985a"