sublimemediumRule

BEC: Executive coaching vendor impersonation

Detects fraudulent messages impersonating leadership development coaching services. The rule identifies inbound messages referencing coaching and executive services terminology alongside financial indicators such as invoices and W-9 forms. Natural language understanding is used to confirm high-confidence financial communication intent and BEC signals.

MITRE ATT&CK

T1566.002 T1534 T1656 T1598.003 T1566 T1598

initial-access

Detection Query

type.inbound
and (
  strings.icontains(body.current_thread.text, "ezra", "hesion")
  or regex.icontains(body.current_thread.text, 'better\s?up', 'coach\s?hub')
)
and strings.icontains(strings.replace_confusables(body.current_thread.text),
                      'leadership development coach',
                      'coaching, leadership development',
                      'accounting & collections department',
                      'executive coach for emerging leaders',
                      'accounts receivable - coaching division'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in (
          "Financial Communications",
          "Payment Information",
          "Request to View Invoice"
        )
        and .confidence == "high"
)
and any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "BEC: Executive coaching vendor impersonation"
description: "Detects fraudulent messages impersonating leadership development coaching services. The rule identifies inbound messages referencing coaching and executive services terminology alongside financial indicators such as invoices and W-9 forms. Natural language understanding is used to confirm high-confidence financial communication intent and BEC signals."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    strings.icontains(body.current_thread.text, "ezra", "hesion")
    or regex.icontains(body.current_thread.text, 'better\s?up', 'coach\s?hub')
  )
  and strings.icontains(strings.replace_confusables(body.current_thread.text),
                        'leadership development coach',
                        'coaching, leadership development',
                        'accounting & collections department',
                        'executive coach for emerging leaders',
                        'accounts receivable - coaching division'
  )
  and any(ml.nlu_classifier(body.current_thread.text).topics,
          .name in (
            "Financial Communications",
            "Payment Information",
            "Request to View Invoice"
          )
          and .confidence == "high"
  )
  and any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")
attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "HTML analysis"
  - "Natural Language Understanding"
id: "e9223f0f-6b74-5d26-a7ed-90cfa0a36d99"