Detection rules › Sublime MQL
BEC/Fraud: Fake investment outreach from suspicious TLD
Detects fake investment solicitation emails using "Investment into {company}" subject lines from suspicious TLDs. This campaign targets businesses with templated cold outreach purporting to represent family offices or private equity firms, using disposable domains with DGA-like characteristics.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering |
Event coverage
| Message attribute |
|---|
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and strings.istarts_with(subject.base, 'investment into')
and sender.email.domain.tld in $suspicious_tlds
Detection logic
Scope: inbound message.
Detects fake investment solicitation emails using "Investment into {company}" subject lines from suspicious TLDs. This campaign targets businesses with templated cold outreach purporting to represent family offices or private equity firms, using disposable domains with DGA-like characteristics.
- inbound message
- subject.base starts with 'investment into'
- sender.email.domain.tld in $suspicious_tlds
Inspects: sender.email.domain.tld, subject.base, type.inbound. Sensors: strings.istarts_with. Reference lists: $suspicious_tlds.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.istarts_with | prefix | investment into |