sublimelowRule

Service abuse: Kagoya.net-hosted domains sending English business lures

Flags inbound mail routed through infrastructure tied to the Japanese hosting provider Kagoya.net where the message body is written in English, a mismatch that surfaces abuse of these mail servers for business-themed lures.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1598.003 T1598

initial-access

Detection Query

type.inbound
and any(headers.domains, .root_domain == "kagoya.net")
and ml.nlu_classifier(body.current_thread.text).language == "english"
and not (
  (length(headers.references) > 0 or headers.in_reply_to is not null)
  and (subject.is_forward or subject.is_reply)
  and length(body.previous_threads) >= 1
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Service abuse: Kagoya.net-hosted domains sending English business lures"
description: "Flags inbound mail routed through infrastructure tied to the Japanese hosting provider Kagoya.net where the message body is written in English, a mismatch that surfaces abuse of these mail servers for business-themed lures."
type: "rule"
severity: "low"
source: |
  type.inbound
  and any(headers.domains, .root_domain == "kagoya.net")
  and ml.nlu_classifier(body.current_thread.text).language == "english"
  and not (
    (length(headers.references) > 0 or headers.in_reply_to is not null)
    and (subject.is_forward or subject.is_reply)
    and length(body.previous_threads) >= 1
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "BEC/Fraud"
  - "Spam"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "Natural Language Understanding"
  - "Header analysis"
  - "Sender analysis"
id: "675ea5f3-43a2-5ee5-b990-288739fd493e"