sublimemediumRule

BEC/Fraud: Contract or order lure with mismatched reply-to

Detects inbound messages where the reply-to address differs from the sender's address, while the subject line references a contract agreement or order with an 8-digit numeric identifier and the body text mentions an attached contract or order. This combination is a common tactic in business email compromise attempts designed to redirect replies to an attacker-controlled address.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1598

initial-access

Detection Query

type.inbound
and any(headers.reply_to, .email.email != sender.email.email)
and regex.icontains(subject.subject, '(?:contract agreement|order)_\d{8}\b')
and regex.icontains(body.current_thread.text,
                    'attached (?:contract agreement|order)'
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "BEC/Fraud: Contract or order lure with mismatched reply-to"
description: "Detects inbound messages where the reply-to address differs from the sender's address, while the subject line references a contract agreement or order with an 8-digit numeric identifier and the body text mentions an attached contract or order. This combination is a common tactic in business email compromise attempts designed to redirect replies to an attacker-controlled address."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(headers.reply_to, .email.email != sender.email.email)
  and regex.icontains(subject.subject, '(?:contract agreement|order)_\d{8}\b')
  and regex.icontains(body.current_thread.text,
                      'attached (?:contract agreement|order)'
  )
attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Spoofing"
  - "Social engineering"
detection_methods:
  - "Header analysis"
  - "Content analysis"
id: "d5bc416a-9289-5827-a748-2b7f1f31736d"