Detection rules › Sublime MQL

Scam: Fake estate sale offering welding equipment and tools

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects fraudulent messages impersonating someone selling inherited or estate items, specifically targeting welding equipment, power tools, and machinery. These messages typically claim items are from a deceased relative's estate or due to relocation, require shipping arrangements, and use emotional manipulation to appear legitimate while requesting contact through alternative channels.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesSocial engineering, Free email provider, Out of band pivot

Event coverage

Rule body MQL

length(body.current_thread.links) < 10
and length(body.current_thread.text) < 3000
and (
  regex.icontains(body.current_thread.text,
                  '(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)\s*[^\r\n]{0,50}(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)',
                  '(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)\s*[^\r\n]{0,50}(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)'
  )
  or regex.icontains(body.current_thread.text,
                     '(?:Caterpillar|\bCAT\b|John\s*Deere|Kubota|Bobcat|Honda|Generac|Stihl|Husqvarna|\bToro\b)\s*[^\r\n]{0,50}(?:\bgenerator\b|\bchainsaw\b|\bexcavator\b|\bskid\s*steer\b|\btractor\b|\bmower\b|\bloader\b|\bbackhoe\b)'
  )
  or regex.icontains(body.current_thread.text,
                     '(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)\s*[^\r\n]{0,50}(?:available|sale|rehome|gift|giving\s*away|free)',
                     '(?:available|sale|rehome|gift|giving\s*away|free)\s*[^\r\n]{0,50}(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)'
  )
  or strings.ilike(body.current_thread.text,
                   '*welding tools*',
                   '*tools and accessories*'
  )
  or (
    length(regex.extract(body.current_thread.text,
                         '(?i)(?:generator|refrigerator|trailer|tractor|lawnmower|mower|washer|dryer|freezer|treadmill|peloton|vanity|dresser|couch|sectional|kennel|mattress|bed\s*frame|hot\s*tub|golf\s*cart|tv|gazebo|loveseat|dishwasher|microwave|kitchenaid|rolex|watch|honda|toyota|ford|chevy|jeep|kubota|bobcat|polaris|kawasaki|macbook|iphone|playstation|ps5|xbox|canon|sony|dji|piano|keyboard|guitar|violin)\b[^\r\n]{0,30}(?:\(\s*\d{2,5}\s*\)|\$\s*\d{2,5}|\bfor\s+\$?\d{2,5})'
           )
    ) >= 5
    and regex.icontains(body.current_thread.text,
                        'late (?:husband|father|dad|wife|mother|mom)',
                        '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate'
    )
  )
)
and (
  regex.icontains(body.current_thread.text,
                  'late (?:husband|father|dad|wife|mother|mom)',
                  '(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate',
                  'inherited instruments',
                  'just lost (?:her|his|their) (?:husband|father|dad|wife|mother|mom)'
  )
  or strings.ilike(body.current_thread.text,
                   '* downsizing *',
                   '* relocating soon *',
                   '* to relocate *',
                   '*prepares to relocate*',
                   '*relocate with*family*'
  )
  or strings.ilike(body.current_thread.text,
                   '*sponsored*giveaway*',
                   '*giveaway*sponsored*',
                   '* generously offering *',
                   '* generous offer *',
                   '*a loving home*',
                   '*a good home*',
                   '*find a new home *',
                   '*rehome these instruments *',
                   '* free donation*'
  )
  or regex.icontains(body.current_thread.text,
                     'giv\w+\s+away\s+(?:her|his|their|my|our)\s+(?:late|deceased|dad|father|mother|husband|wife)',
                     'giv\w+\s+away\s+(?:her|his|their|my|our)[^\r\n]{0,40}(?:tool|welder|welding|equipment|instrument|machine)'
  )
  or strings.ilike(body.current_thread.text,
                   '*generous opportunity*',
                   '*who needs a reliable*',
                   '*comprehensive set of tools*',
                   '*top-of-the-line machine*'
  )
)
and (
  regex.icontains(body.current_thread.text,
                  'shipping (?:fee|cost|arrangement)',
                  '(?:responsible|pay) for shipping',
                  'no (?:local\s)?pick.?up',
                  '(?:local\s)?pick.?up.{0,50}not available',
                  'delivery only',
                  'moving company'
  )
  or strings.ilike(body.current_thread.text,
                   '* if you will take it *',
                   '* or have someone *',
                   '* indicate your interest *',
                   '* to someone you know *',
                   '* know someone who *',
                   '* someone you know would *',
                   '* someone who will *',
                   '* someone who truly *',
                   '* anyone you know *'
  )
  or regex.icontains(body.current_thread.text,
                     'if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested',
                     '(?:any|some)one[^\r\n]{0,20}(is|will|would|might be)[^\r\n]{0,20}interested',
                     'who (?:will|would|might) appreciate'
  )
  or (
    any(regex.extract(body.current_thread.text,
                      "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
        ),
        strings.parse_email(.full_match).domain.domain in $free_email_providers
        or strings.parse_email(.full_match).domain.root_domain in $free_email_providers
    )
    or (
      length(headers.reply_to) > 0
      and sender.email.email not in map(headers.reply_to, .email.email)
    )
    or length(recipients.to) == 0
    or regex.icontains(body.current_thread.text,
                       '(?:call|contact|text)[^\r\n]{0,50} at'
    )
    or regex.icontains(body.current_thread.text,
                       '(?:private|personal|primary) (?:e-?)?mail'
    )
    or strings.icontains(body.current_thread.text,
                         'happy to answer any questions you may have'
    )
    or strings.icontains(body.current_thread.text, ' kindly ')
    or strings.icontains(body.current_thread.text, ' (kindly ')
  )
)

Detection logic

Detects fraudulent messages impersonating someone selling inherited or estate items, specifically targeting welding equipment, power tools, and machinery. These messages typically claim items are from a deceased relative's estate or due to relocation, require shipping arrangements, and use emotional manipulation to appear legitimate while requesting contact through alternative channels.

  1. length(body.current_thread.links) < 10
  2. length(body.current_thread.text) < 3000
  3. any of:
    • body.current_thread.text matches any of 2 patterns
      • (?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)\s*[^\r\n]{0,50}(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)
      • (?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)\s*[^\r\n]{0,50}(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)
    • body.current_thread.text matches '(?:Caterpillar|\\bCAT\\b|John\\s*Deere|Kubota|Bobcat|Honda|Generac|Stihl|Husqvarna|\\bToro\\b)\\s*[^\\r\\n]{0,50}(?:\\bgenerator\\b|\\bchainsaw\\b|\\bexcavator\\b|\\bskid\\s*steer\\b|\\btractor\\b|\\bmower\\b|\\bloader\\b|\\bbackhoe\\b)'
    • body.current_thread.text matches any of 2 patterns
      • (?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)\s*[^\r\n]{0,50}(?:available|sale|rehome|gift|giving\s*away|free)
      • (?:available|sale|rehome|gift|giving\s*away|free)\s*[^\r\n]{0,50}(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)
    • body.current_thread.text matches any of 2 patterns
      • *welding tools*
      • *tools and accessories*
    • all of:
      • length(regex.extract(body.current_thread.text, '(?i)(?:generator|refrigerator|trailer|tractor|lawnmower|mower|washer|dryer|freezer|treadmill|peloton|vanity|dresser|couch|sectional|kennel|mattress|bed\\s*frame|hot\\s*tub|golf\\s*cart|tv|gazebo|loveseat|dishwasher|microwave|kitchenaid|rolex|watch|honda|toyota|ford|chevy|jeep|kubota|bobcat|polaris|kawasaki|macbook|iphone|playstation|ps5|xbox|canon|sony|dji|piano|keyboard|guitar|violin)\\b[^\\r\\n]{0,30}(?:\\(\\s*\\d{2,5}\\s*\\)|\\$\\s*\\d{2,5}|\\bfor\\s+\\$?\\d{2,5})')) ≥ 5
      • body.current_thread.text matches any of 2 patterns
        • late (?:husband|father|dad|wife|mother|mom)
        • (?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate
  4. body.current_thread.text matches any of 24 patterns
    • late (?:husband|father|dad|wife|mother|mom)
    • (?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate
    • inherited instruments
    • just lost (?:her|his|their) (?:husband|father|dad|wife|mother|mom)
    • * downsizing *
    • * relocating soon *
    • * to relocate *
    • *prepares to relocate*
    • *relocate with*family*
    • *sponsored*giveaway*
    • *giveaway*sponsored*
    • * generously offering *
    • * generous offer *
    • *a loving home*
    • *a good home*
    • *find a new home *
    • *rehome these instruments *
    • * free donation*
    • giv\w+\s+away\s+(?:her|his|their|my|our)\s+(?:late|deceased|dad|father|mother|husband|wife)
    • giv\w+\s+away\s+(?:her|his|their|my|our)[^\r\n]{0,40}(?:tool|welder|welding|equipment|instrument|machine)
    • *generous opportunity*
    • *who needs a reliable*
    • *comprehensive set of tools*
    • *top-of-the-line machine*
  5. any of:
    • body.current_thread.text matches any of 6 patterns
      • shipping (?:fee|cost|arrangement)
      • (?:responsible|pay) for shipping
      • no (?:local\s)?pick.?up
      • (?:local\s)?pick.?up.{0,50}not available
      • delivery only
      • moving company
    • body.current_thread.text matches any of 9 patterns
      • * if you will take it *
      • * or have someone *
      • * indicate your interest *
      • * to someone you know *
      • * know someone who *
      • * someone you know would *
      • * someone who will *
      • * someone who truly *
      • * anyone you know *
    • body.current_thread.text matches any of 3 patterns
      • if you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested
      • (?:any|some)one[^\r\n]{0,20}(is|will|would|might be)[^\r\n]{0,20}interested
      • who (?:will|would|might) appreciate
    • any of:
      • any of regex.extract(body.current_thread.text) where any holds:
        • strings.parse_email(.full_match).domain.domain in $free_email_providers
        • strings.parse_email(.full_match).domain.root_domain in $free_email_providers
      • all of:
        • length(headers.reply_to) > 0
        • sender.email.email not in map(headers.reply_to, .email.email)
      • length(recipients.to) is 0
      • body.current_thread.text matches '(?:call|contact|text)[^\\r\\n]{0,50} at'
      • body.current_thread.text matches '(?:private|personal|primary) (?:e-?)?mail'
      • body.current_thread.text contains 'happy to answer any questions you may have'
      • body.current_thread.text contains ' kindly '
      • body.current_thread.text contains ' (kindly '

Inspects: body.current_thread.links, body.current_thread.text, headers.reply_to, headers.reply_to[].email.email, recipients.to, sender.email.email. Sensors: regex.extract, regex.icontains, strings.icontains, strings.ilike, strings.parse_email. Reference lists: $free_email_providers.

Indicators matched (56)

FieldMatchValue
regex.icontainsregex(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)\s*[^\r\n]{0,50}(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)
regex.icontainsregex(?:\bwelder\b|\bwelding\b|\bTIG\b|\bMIG\b|plasma\s*cutter)\s*[^\r\n]{0,50}(?:Miller|Lincoln\s*Electric|Hobart|ESAB|Fronius|Everlast|Hypertherm|Thermal\s*Dynamics)
regex.icontainsregex(?:Caterpillar|\bCAT\b|John\s*Deere|Kubota|Bobcat|Honda|Generac|Stihl|Husqvarna|\bToro\b)\s*[^\r\n]{0,50}(?:\bgenerator\b|\bchainsaw\b|\bexcavator\b|\bskid\s*steer\b|\btractor\b|\bmower\b|\bloader\b|\bbackhoe\b)
regex.icontainsregex(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)\s*[^\r\n]{0,50}(?:available|sale|rehome|gift|giving\s*away|free)
regex.icontainsregex(?:available|sale|rehome|gift|giving\s*away|free)\s*[^\r\n]{0,50}(?:welding\s*tools|power\s*tools|tool\s+(?:box|chest|set|kit|collection)|toolbox|toolchest)
strings.ilikesubstring*welding tools*
strings.ilikesubstring*tools and accessories*
regex.extractregex(?i)(?:generator|refrigerator|trailer|tractor|lawnmower|mower|washer|dryer|freezer|treadmill|peloton|vanity|dresser|couch|sectional|kennel|mattress|bed\s*frame|hot\s*tub|golf\s*cart|tv|gazebo|loveseat|dishwasher|microwave|kitchenaid|rolex|watch|honda|toyota|ford|chevy|jeep|kubota|bobcat|polaris|kawasaki|macbook|iphone|playstation|ps5|xbox|canon|sony|dji|piano|keyboard|guitar|violin)\b[^\r\n]{0,30}(?:\(\s*\d{2,5}\s*\)|\$\s*\d{2,5}|\bfor\s+\$?\d{2,5})
regex.icontainsregexlate (?:husband|father|dad|wife|mother|mom)
regex.icontainsregex(?:husband|father|dad|wife|mother|mom)[^\r\n]{0,50}estate
regex.icontainsregexinherited instruments
regex.icontainsregexjust lost (?:her|his|their) (?:husband|father|dad|wife|mother|mom)
44 more
strings.ilikesubstring* downsizing *
strings.ilikesubstring* relocating soon *
strings.ilikesubstring* to relocate *
strings.ilikesubstring*prepares to relocate*
strings.ilikesubstring*relocate with*family*
strings.ilikesubstring*sponsored*giveaway*
strings.ilikesubstring*giveaway*sponsored*
strings.ilikesubstring* generously offering *
strings.ilikesubstring* generous offer *
strings.ilikesubstring*a loving home*
strings.ilikesubstring*a good home*
strings.ilikesubstring*find a new home *
strings.ilikesubstring*rehome these instruments *
strings.ilikesubstring* free donation*
regex.icontainsregexgiv\w+\s+away\s+(?:her|his|their|my|our)\s+(?:late|deceased|dad|father|mother|husband|wife)
regex.icontainsregexgiv\w+\s+away\s+(?:her|his|their|my|our)[^\r\n]{0,40}(?:tool|welder|welding|equipment|instrument|machine)
strings.ilikesubstring*generous opportunity*
strings.ilikesubstring*who needs a reliable*
strings.ilikesubstring*comprehensive set of tools*
strings.ilikesubstring*top-of-the-line machine*
regex.icontainsregexshipping (?:fee|cost|arrangement)
regex.icontainsregex(?:responsible|pay) for shipping
regex.icontainsregexno (?:local\s)?pick.?up
regex.icontainsregex(?:local\s)?pick.?up.{0,50}not available
regex.icontainsregexdelivery only
regex.icontainsregexmoving company
strings.ilikesubstring* if you will take it *
strings.ilikesubstring* or have someone *
strings.ilikesubstring* indicate your interest *
strings.ilikesubstring* to someone you know *
strings.ilikesubstring* know someone who *
strings.ilikesubstring* someone you know would *
strings.ilikesubstring* someone who will *
strings.ilikesubstring* someone who truly *
strings.ilikesubstring* anyone you know *
regex.icontainsregexif you[^\r\n]{0,20}(?:(?:might|will|would) be|are)[^\r\n]{0,20}interested
regex.icontainsregex(?:any|some)one[^\r\n]{0,20}(is|will|would|might be)[^\r\n]{0,20}interested
regex.icontainsregexwho (?:will|would|might) appreciate
regex.extractregex[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}
regex.icontainsregex(?:call|contact|text)[^\r\n]{0,50} at
regex.icontainsregex(?:private|personal|primary) (?:e-?)?mail
strings.icontainssubstringhappy to answer any questions you may have
strings.icontainssubstring kindly
strings.icontainssubstring (kindly