sublimemediumRule

Spam: Large financial amount mention from newly registered sender domain

Detects inbound messages from domains less than 180 days old that solicit investment interest from named organizations or individuals on behalf of a purported private family office. Senders use financial-sounding names and rotate first names and target company names while keeping the subject line structure nearly identical. The outreach is designed to appear as a legitimate investment inquiry to bait a response.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1598

initial-access

Detection Query

type.inbound
and network.whois(sender.email.domain).days_old < 180
and any([body.html.display_text, subject.base],
        regex.icontains(., '\$\d\p{Pd}\$\d{1,2}(?:m\b|million)')
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Spam: Large financial amount mention from newly registered sender domain"
description: "Detects inbound messages from domains less than 180 days old that solicit investment interest from named organizations or individuals on behalf of a purported private family office. Senders use financial-sounding names and rotate first names and target company names while keeping the subject line structure nearly identical. The outreach is designed to appear as a legitimate investment inquiry to bait a response."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and network.whois(sender.email.domain).days_old < 180
  and any([body.html.display_text, subject.base],
          regex.icontains(., '\$\d\p{Pd}\$\d{1,2}(?:m\b|million)')
  )
attack_types:
  - "BEC/Fraud"
  - "Spam"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Sender analysis"
  - "Whois"
id: "e28e1597-6a89-562e-b1e9-e551c5ac4fdd"