
Summary
Detects inbound messages originating from free email providers that attempt unsolicited book/author promotion. The rule analyzes the message thread text for a Goodreads reference, language that frames the recipient as the author of their work (e.g., 'your book', 'your manuscript'), and marketing-oriented phrases suggesting being featured or invited for a promotion (e.g., 'featur', 'spotlight', 'showcase', 'invite you', 'selected your', 'reading circle'). It applies a negative condition to suppress alerts for highly trusted senders if their DMARC authentication passes, effectively requiring that the sender is not from a trusted domain or that DMARC failed. This is a content-analysis based detection with a low severity, targeting social-engineering style promotion scams in inbound email.
Categories
- Web
- Application
Data Sources
- Application Log
- Process
Created: 2026-07-26