sublimemediumRule

Attachment: Embedded MSG file with payment lure and newly registered domain

Detects inbound messages carrying an .msg attachment that itself contains an embedded email. The nested message combines financial fraud language—references to ACH/wire transfers, invoices, remittance, or urgency-based payment discounts—with a link to a domain registered within the last 30 days, a pattern consistent with business email compromise or invoice fraud schemes hiding their payload inside a forwarded or attached message to evade detection.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and any(filter(attachments, .file_extension =~ "msg"),
        any(file.explode(.),
            // payment request inside the embedded message
            2 of (
              regex.icontains(.scan.strings.raw,
                              '\b(?:ach|wire transfer|remit(?:ted|tance)?)\b'
              ),
              strings.icontains(.scan.strings.raw, 'invoice'),
              regex.icontains(.scan.strings.raw,
                              'payment discount|keep the discount|by (?:today|tomorrow|end of (the )?day)'
              ),
              any(ml.nlu_classifier(.scan.strings.raw).topics,
                  .name == 'Request to View Invoice'
              )
            )
            // newly registered domain referenced in the embedded message
            and any(.scan.url.urls, network.whois(.domain).days_old < 30)
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Embedded MSG file with payment lure and newly registered domain"
description: "Detects inbound messages carrying an .msg attachment that itself contains an embedded email. The nested message combines financial fraud language—references to ACH/wire transfers, invoices, remittance, or urgency-based payment discounts—with a link to a domain registered within the last 30 days, a pattern consistent with business email compromise or invoice fraud schemes hiding their payload inside a forwarded or attached message to evade detection."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(filter(attachments, .file_extension =~ "msg"),
          any(file.explode(.),
              // payment request inside the embedded message
              2 of (
                regex.icontains(.scan.strings.raw,
                                '\b(?:ach|wire transfer|remit(?:ted|tance)?)\b'
                ),
                strings.icontains(.scan.strings.raw, 'invoice'),
                regex.icontains(.scan.strings.raw,
                                'payment discount|keep the discount|by (?:today|tomorrow|end of (the )?day)'
                ),
                any(ml.nlu_classifier(.scan.strings.raw).topics,
                    .name == 'Request to View Invoice'
                )
              )
              // newly registered domain referenced in the embedded message
              and any(.scan.url.urls, network.whois(.domain).days_old < 30)
          )
  )
attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "File analysis"
  - "Content analysis"
  - "URL analysis"
  - "Whois"
  - "Natural Language Understanding"
id: "fa7b121f-7f91-515a-9912-1e50398730db"