detection.wiki

Detection rules › Sublime MQL

BEC/Fraud: Romance scam

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule detects messages attempting to initiate a Romance scam. The rule leverage tells such as undisclosed recipients, freemail emails in the body and common scam phrasing. Romance scams are deceptive schemes where scammers establish false romantic intentions towards individuals to gain their trust and eventually exploit them financially.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesFree email provider, Social engineering

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
sender
sender.email
type

Rule body MQL

type.inbound
// no links
and (
  length(body.links) == 0
  // or 1 link, but link doesn't match the sender's domain
  or (
    length(body.links) == 1
    and sender.email.domain.root_domain not in $free_email_providers
    and all(body.links,
            .href_url.domain.root_domain != sender.email.domain.root_domain
    )
  )
)
// no attachments
and length(attachments) == 0
and (
  (
    // honorific
    regex.icontains(sender.display_name,
                    '(?:Mr|Mrs|Ms|Miss|Dr|Prof|Sir|Lady|Rev)\.?[ \t]+'
    )
    // And an email is found in the body, and a freemail domain is found also
    and regex.contains(body.current_thread.text,
                       "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
    )
    and any($free_email_providers,
            strings.icontains(body.current_thread.text, .)
    )
    // scammy phrases
    and regex.icontains(body.current_thread.text,
                        '(?:I am|My name is) .* (?:from|staying in) .+\.',
                        '(?:years old|cm|kg).*\.',
                        '(?:photo|pictures|sexy).*\.',
                        '(?:email|contact me|write to me|reply to me) at .*@.*\.'
    )
  )
  or (
    // simple firstname lastname from freemail
    sender.email.domain.root_domain in $free_email_providers
    and regex.match(sender.display_name, '[A-Z][a-z]+ [A-Z][a-z]+')
    // short message
    and length(body.current_thread.text) < 200
    and regex.icontains(body.current_thread.text,
                        "(?:I am|My name is) [^.!?]{1,30} from [^.!?]{1,50}[.!?,]"
    )
    and regex.icontains(body.current_thread.text,
                        '(?:can I|please) (?:talk to|contact|meet|chat with) (?:you|me)'
    )
  )
)

Detection logic

Scope: inbound message.

This rule detects messages attempting to initiate a Romance scam. The rule leverage tells such as undisclosed recipients, freemail emails in the body and common scam phrasing. Romance scams are deceptive schemes where scammers establish false romantic intentions towards individuals to gain their trust and eventually exploit them financially.

  1. inbound message
  2. any of:
    • length(body.links) is 0
    • all of:
      • length(body.links) is 1
      • sender.email.domain.root_domain not in $free_email_providers
      • all of body.links where:
        • .href_url.domain.root_domain is not sender.email.domain.root_domain
  3. length(attachments) is 0
  4. any of:
    • all of:
      • sender.display_name matches '(?:Mr|Mrs|Ms|Miss|Dr|Prof|Sir|Lady|Rev)\\.?[ \\t]+'
      • body.current_thread.text matches '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\\\.[A-Za-z]{2,}'
      • any of $free_email_providers where:
        • strings.icontains(body.current_thread.text)
      • body.current_thread.text matches any of 4 patterns
        • (?:I am|My name is) .* (?:from|staying in) .+\.
        • (?:years old|cm|kg).*\.
        • (?:photo|pictures|sexy).*\.
        • (?:email|contact me|write to me|reply to me) at .*@.*\.
    • all of:
      • sender.email.domain.root_domain in $free_email_providers
      • sender.display_name matches '[A-Z][a-z]+ [A-Z][a-z]+'
      • length(body.current_thread.text) < 200
      • body.current_thread.text matches '(?:I am|My name is) [^.!?]{1,30} from [^.!?]{1,50}[.!?,]'
      • body.current_thread.text matches '(?:can I|please) (?:talk to|contact|meet|chat with) (?:you|me)'

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: regex.contains, regex.icontains, regex.match, strings.icontains. Reference lists: $free_email_providers.

Indicators matched (9)

FieldMatchValue
regex.icontainsregex(?:Mr|Mrs|Ms|Miss|Dr|Prof|Sir|Lady|Rev)\.?[ \t]+
regex.containsregex[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}
regex.icontainsregex(?:I am|My name is) .* (?:from|staying in) .+\.
regex.icontainsregex(?:years old|cm|kg).*\.
regex.icontainsregex(?:photo|pictures|sexy).*\.
regex.icontainsregex(?:email|contact me|write to me|reply to me) at .*@.*\.
regex.matchregex[A-Z][a-z]+ [A-Z][a-z]+
regex.icontainsregex(?:I am|My name is) [^.!?]{1,30} from [^.!?]{1,50}[.!?,]
regex.icontainsregex(?:can I|please) (?:talk to|contact|meet|chat with) (?:you|me)