Sublime MQL rules: bec

type.inbound

// undisclosed recipients
and any([recipients.to, recipients.bcc, recipients.cc],
        any(., .display_name =~ "Undisclosed recipients")
)

// mismatched sender (from) and Reply-to
and (
  length(headers.reply_to) > 0
  and all(headers.reply_to,
          .email.domain.root_domain != sender.email.domain.root_domain
  )
)

// generic recipient
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "recipient" and regex.icontains(.text, "(sir|madam)")
)

// request made
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "request"
)

// not a bec scam
and all(ml.nlu_classifier(body.current_thread.text).intents, .name != "bec")

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound

// the sender or the reply-to is a freemail provider
and (
  sender.email.domain.domain in $free_email_providers
  or (
    not sender.email.domain.root_domain in $free_email_providers
    and any(headers.reply_to,
            .email.domain.root_domain in $free_email_providers
    )
  )
)

// body contains pen ?pal
and regex.contains(body.current_thread.text, 'pen\s?pal')

// and NLU Request
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "request"
)

// not a reply
and (length(headers.references) == 0 or headers.in_reply_to is null)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and subject.is_reply
and length(attachments) == 0
// short current thread
and length(body.current_thread.text) < 25
// only 1 previous thread
and length(body.previous_threads) == 1
and any(recipients.to,
        .email.domain.root_domain != sender.email.domain.root_domain
)
// urgent or authority based keywords in sender display name or local part
and (
  regex.icontains(sender.display_name,
                  '\b(?:(?:crucial|urgent|immediate|important|quick)(?:ly)?|immediatetask|emergency)\b'
  )
  or regex.icontains(sender.email.local_part, '(?:task|ceo|executive)')
)
// sender replied to themselves
and any(body.previous_threads, strings.icontains(.preamble, sender.email.email))

type.inbound
// no links
and (
  length(body.links) == 0
  // or 1 link, but link doesn't match the sender's domain
  or (
    length(body.links) == 1
    and sender.email.domain.root_domain not in $free_email_providers
    and all(body.links,
            .href_url.domain.root_domain != sender.email.domain.root_domain
    )
  )
)
// no attachments
and length(attachments) == 0
and (
  (
    // honorific
    regex.icontains(sender.display_name,
                    '(?:Mr|Mrs|Ms|Miss|Dr|Prof|Sir|Lady|Rev)\.?[ \t]+'
    )
    // And an email is found in the body, and a freemail domain is found also
    and regex.contains(body.current_thread.text,
                       "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
    )
    and any($free_email_providers,
            strings.icontains(body.current_thread.text, .)
    )
    // scammy phrases
    and regex.icontains(body.current_thread.text,
                        '(?:I am|My name is) .* (?:from|staying in) .+\.',
                        '(?:years old|cm|kg).*\.',
                        '(?:photo|pictures|sexy).*\.',
                        '(?:email|contact me|write to me|reply to me) at .*@.*\.'
    )
  )
  or (
    // simple firstname lastname from freemail
    sender.email.domain.root_domain in $free_email_providers
    and regex.match(sender.display_name, '[A-Z][a-z]+ [A-Z][a-z]+')
    // short message
    and length(body.current_thread.text) < 200
    and regex.icontains(body.current_thread.text,
                        "(?:I am|My name is) [^.!?]{1,30} from [^.!?]{1,50}[.!?,]"
    )
    and regex.icontains(body.current_thread.text,
                        '(?:can I|please) (?:talk to|contact|meet|chat with) (?:you|me)'
    )
  )
)

type.inbound

// body is short
and length(body.current_thread.text) < 800

// one recipient
and length(recipients.to) == 1

// all recipients are the sender
and all(recipients.to,
        .email.email == sender.email.email
        and (
          .email.domain.valid or strings.icontains(.display_name, "undisclosed")
        )
)

// not an org domain
and all(recipients.to,
        .email.domain.root_domain not in $org_domains
        and (
          .email.domain.valid or strings.icontains(.display_name, "undisclosed")
        )
)

// one link
and length(body.links) == 1

// links don't match sender
and all(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
)

// scam indicators
and regex.icontains(body.current_thread.text,
                    '((?:Mr|Mrs|Ms|Miss|Dr|Prof|Sir|Lady|Rev)\.?[ \t]+)|(sir|madam|kindly)|(dringend|eingefordert|anspruch)'
)

// body contains an email address to a freemail provider
and (
  regex.contains(body.current_thread.text,
                 "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
  )
  and any($free_email_providers, strings.icontains(body.current_thread.text, .))
)

type.inbound
// there is no HTML body
and body.html.raw is null

// but the current thread contains what's most likely an html tag
// (eg. <>'s' followed by a closing </> )
and regex.contains(body.current_thread.text, '<[^>]+>.*?</[^>]+>')

// and the body mentions student loans
and strings.icontains(body.current_thread.text, "Student Loan")

// sourced from a free mail provider
and sender.email.domain.root_domain in $free_email_providers

// contains a phone number
and (
  regex.contains(strings.replace_confusables(body.current_thread.text),
                 '\+?(\d{1}.)?\(?\d{3}?\)?.\d{3}.?\d{4}'
  )
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '\+\d{1,3}[ilo0-9]{10}'
  )
  // +12028001238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '[ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}'
  )
  // 202.800.1238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}'
  )
  // 202-800-1238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '\([ilo0-9]{3}\)\s[ilo0-9]{3}-[ilo0-9]{4}'
  )
  // (202) 800-1238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '\([ilo0-9]{3}\)[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}'
  )
  // (202)-800-1238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '1 [ilo0-9]{3} [ilo0-9]{3} [ilo0-9]{4}'
  ) // 8123456789
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '8\d{9}'
  )
)

// contains a request
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "request"
)

type.inbound
and strings.icontains(subject.base,
                      "Offer to Purchase",
                      "Transaction Opportunity"
)
and (
  strings.icontains(body.plain.raw,
                    "private equity",
                    "acquiring companies",
                    "discuss the opportunity",
                    "pe firm"
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "financial" and strings.icontains(.text, "purchase")
    )
    and any(ml.nlu_classifier(body.current_thread.text).topics,
            .name == "B2B Cold Outreach" and .confidence == "high"
    )
  )
)

type.inbound
and 3 of (
  // urgent subjects
  strings.ilike(subject.subject, '*quick question*'),
  strings.ilike(subject.subject, '*urgent*request*'),
  strings.ilike(subject.subject, '*are you available*'),
  strings.ilike(subject.subject, '*need assistance*'),
  strings.ilike(subject.subject, '*help*needed*'),
  regex.icontains(subject.subject, 'favor\b'),
  strings.ilike(subject.subject, '*checking in*'),
  strings.ilike(subject.subject, '*awaiting*response*'),
  strings.ilike(subject.subject, '*catch*up*'),

  // BEC body patterns
  strings.ilike(body.current_thread.text, '*sorry to bother*'),
  strings.ilike(body.current_thread.text, '*are you busy*'),
  strings.ilike(body.current_thread.text, '*can you help*'),
  strings.ilike(body.current_thread.text, '*do you have a moment*'),
  strings.ilike(body.current_thread.text, '*please respond*asap*'),
  strings.ilike(subject.subject, '*quick question*'),

  // brand name
  regex.icontains(body.current_thread.text, 'a\s?m\s?a\s?z\s?[o0]\s?n'), // Catches "Amaz on", "Amazon", etc.
  regex.icontains(body.current_thread.text, 'p\s?a\s?y\s?p\s?a\s?l'),
  regex.icontains(body.current_thread.text, 'a\s?p\s?p\s?l\s?e'),

  // short body
  length(body.current_thread.text) < 200,
  strings.count(body.current_thread.text, ' ') < 30
)
and 3 of (
  // suspicious sender
  sender.email.domain.root_domain in $free_email_providers,
  network.whois(sender.email.domain).days_old < 30,

  // suspicious recipient pattern
  any(recipients.to, strings.ilike(.display_name, 'undisclosed?recipients')),
  length(recipients.to) <= 1, // Single or 0 recipients

  // header checks
  strings.starts_with(headers.mailer, 'Open-Xchange Mailer'),
  strings.ilike(headers.x_originating_ip.ip, '*.*.*.0'), // Common in some BEC campaigns
  // deifferent reply-to address
  (
    length(headers.reply_to) > 0
    and sender.email.email not in map(headers.reply_to, .email.email)
  ),
  // sender display name is part of the subject
  strings.icontains(subject.subject, sender.display_name),
)
and profile.by_sender_email().prevalence not in ("common")

type.inbound
and (
  strings.icontains(body.current_thread.text, "ezra", "hesion")
  or regex.icontains(body.current_thread.text, 'better\s?up', 'coach\s?hub')
)
and strings.icontains(strings.replace_confusables(body.current_thread.text),
                      'leadership development coach',
                      'coaching, leadership development',
                      'accounting & collections department',
                      'executive coach for emerging leaders',
                      'accounts receivable - coaching division'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in (
          "Financial Communications",
          "Payment Information",
          "Request to View Invoice"
        )
        and .confidence == "high"
)
and any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")

type.inbound
and strings.starts_with(headers.mailer, 'Open-Xchange Mailer')
and strings.ends_with(headers.message_id, '@privateemail.com>')
and regex.imatch(sender.email.domain.sld, '.*(?:llc|ltd|inc|corp|llp|co)')
and not sender.email.domain.root_domain == "simpelllc.com"