sublimemediumRule

BEC/Fraud: B2B sales inquiry cold outreach lure

Detects inbound plain-text messages that mimic sales inquiries or project discussion requests, using language referencing sales teams, project requirements, and procurement officers to establish false business legitimacy. An NLU classifier confirms the message content aligns with B2B cold outreach or purchase order themes, a common pretext used to initiate contact before pivoting to fraudulent business proposals or follow-on scams.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1598

initial-access

Detection Query

type.inbound
and body.html.raw is null
and strings.icontains(subject.base, 'sales inquiry', 'project discussion')
and strings.icontains(body.current_thread.text,
                      'sales team',
                      'project and requirements',
                      'chief procurement officer',
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in ("B2B Cold Outreach", "Purchase Orders")
        and .confidence != "low"
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "BEC/Fraud: B2B sales inquiry cold outreach lure"
description: "Detects inbound plain-text messages that mimic sales inquiries or project discussion requests, using language referencing sales teams, project requirements, and procurement officers to establish false business legitimacy. An NLU classifier confirms the message content aligns with B2B cold outreach or purchase order themes, a common pretext used to initiate contact before pivoting to fraudulent business proposals or follow-on scams."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and body.html.raw is null
  and strings.icontains(subject.base, 'sales inquiry', 'project discussion')
  and strings.icontains(body.current_thread.text,
                        'sales team',
                        'project and requirements',
                        'chief procurement officer',
  )
  and any(ml.nlu_classifier(body.current_thread.text).topics,
          .name in ("B2B Cold Outreach", "Purchase Orders")
          and .confidence != "low"
  )
attack_types:
  - "BEC/Fraud"
  - "Spam"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Natural Language Understanding"
id: "9e8b2c52-cd9b-5bd2-b204-282f3430ade2"