sublimemediumRule

Link: Gmail confidential mode message with job scam subject

Detects Gmail confidential mode messages where the sender-controlled subject, rendered as the message link text, or the sender address contains job scam or recruitment language.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1566.001 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and any(body.current_thread.links,
        .href_url.domain.domain == "confidential-mail.google.com"
        and strings.istarts_with(.href_url.path, "/msg/")
)
and (
  // the sender-controlled subject is rendered as the link text
  any(filter(body.current_thread.links,
             .href_url.domain.domain == "confidential-mail.google.com"
      ),
      any(ml.nlu_classifier(.display_text).intents,
          .name == "job_scam" and .confidence in ("medium", "high")
      )
      // compensation figures such as "$450K–$900K+"
      or any(ml.nlu_classifier(.display_text).entities,
             .name == "financial" and regex.contains(.text, '\d\s*[kKmM]\b')
      )
      // recruitment terms in the subject
      or regex.icontains(.display_text,
                         '\b(?:leader(?:ship)?|director|mandate|opportunit(?:y|ies)|executive.search|career|jobs?|role)\b'
      )
  )
  // recruitment terms in the sender local part
  or regex.icontains(sender.email.local_part,
                     '(?:recruit|talent|staffing|executive.?s[ea]|career)'
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Gmail confidential mode message with job scam subject"
description: "Detects Gmail confidential mode messages where the sender-controlled subject, rendered as the message link text, or the sender address contains job scam or recruitment language."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.current_thread.links,
          .href_url.domain.domain == "confidential-mail.google.com"
          and strings.istarts_with(.href_url.path, "/msg/")
  )
  and (
    // the sender-controlled subject is rendered as the link text
    any(filter(body.current_thread.links,
               .href_url.domain.domain == "confidential-mail.google.com"
        ),
        any(ml.nlu_classifier(.display_text).intents,
            .name == "job_scam" and .confidence in ("medium", "high")
        )
        // compensation figures such as "$450K–$900K+"
        or any(ml.nlu_classifier(.display_text).entities,
               .name == "financial" and regex.contains(.text, '\d\s*[kKmM]\b')
        )
        // recruitment terms in the subject
        or regex.icontains(.display_text,
                           '\b(?:leader(?:ship)?|director|mandate|opportunit(?:y|ies)|executive.search|career|jobs?|role)\b'
        )
    )
    // recruitment terms in the sender local part
    or regex.icontains(sender.email.local_part,
                       '(?:recruit|talent|staffing|executive.?s[ea]|career)'
    )
  )
attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Natural Language Understanding"
  - "Sender analysis"
  - "URL analysis"
id: "d27dc9bc-1d01-5b70-aafb-acf18837423f"