detection.wiki

Detection rules › Sublime MQL

BEC/Fraud: Penpal scam

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule detects messages from individuals looking to establish contact under the guise of seeking friendship or a penpal relationship. Over time, they build trust and then exploit this relationship by asking for money, personal information, or involvement in suspicious activities.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesFree email provider, Social engineering

Event coverage

Message attribute
body.current_thread
headers (collection)
headers.auth_summary
headers.reply_to (collection)
sender.email
type

Rule body MQL

type.inbound

// the sender or the reply-to is a freemail provider
and (
  sender.email.domain.domain in $free_email_providers
  or any(headers.reply_to,
         .email.domain.root_domain in $free_email_providers
         and not sender.email.domain.root_domain in $free_email_providers
  )
)

// body contains pen ?pal
and regex.contains(body.current_thread.text, 'pen\s?pal')

// and NLU Request
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "request"
)

// not a reply
and (length(headers.references) == 0 or headers.in_reply_to is null)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

This rule detects messages from individuals looking to establish contact under the guise of seeking friendship or a penpal relationship. Over time, they build trust and then exploit this relationship by asking for money, personal information, or involvement in suspicious activities.

  1. inbound message
  2. any of:
    • sender.email.domain.domain in $free_email_providers
    • any of headers.reply_to where all hold:
      • .email.domain.root_domain in $free_email_providers
      • not:
        • sender.email.domain.root_domain in $free_email_providers
  3. body.current_thread.text matches 'pen\\s?pal'
  4. any of ml.nlu_classifier(body.current_thread.text).entities where:
    • .name is 'request'
  5. any of:
    • length(headers.references) is 0
    • headers.in_reply_to is missing
  6. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.in_reply_to, headers.references, headers.reply_to, headers.reply_to[].email.domain.root_domain, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, regex.contains. Reference lists: $free_email_providers, $high_trust_sender_root_domains.

Indicators matched (2)

FieldMatchValue
regex.containsregexpen\s?pal
ml.nlu_classifier(body.current_thread.text).entities[].nameequalsrequest