heroui logo

BEC/Fraud: B2B sales inquiry cold outreach lure

Sublime Rules

View Source
Summary
Detects inbound plain-text messages that resemble B2B cold outreach or purchase-order pretexts used in business email compromise (BEC) and fraud. The rule targets messages with subject hints like 'sales inquiry' or 'project discussion' and body content referencing 'sales team', 'project and requirements', or 'chief procurement officer' to establish false business legitimacy. An NLU classifier is invoked on the message text to identify topics named 'B2B Cold Outreach' or 'Purchase Orders' with a confidence level that is not 'low'. If these cues align, the rule fires to flag potential fraud or spam. The detection relies on content analysis and natural language understanding and is scoped to inbound plain-text messages (body.html.raw is null), ensuring it captures text-based outreach attempts rather than HTML payloads.
Categories
  • Endpoint
  • Web
Data Sources
  • Process
  • Application Log
Created: 2026-09-25