Sublime Security medium experimental mql

BEC: Executive coaching vendor impersonation

Detects fraudulent messages impersonating leadership development coaching services. The rule identifies inbound messages referencing coaching and executive services terminology alongside financial indicators such as invoices and W-9 forms. Natural language understanding is used to confirm high-confidence financial communication intent and BEC signals.

View Source

Detection Logic

type.inbound
and (
  strings.icontains(body.current_thread.text, "ezra", "hesion")
  or regex.icontains(body.current_thread.text, 'better\s?up', 'coach\s?hub')
)
and strings.icontains(strings.replace_confusables(body.current_thread.text),
                      'leadership development coach',
                      'coaching, leadership development',
                      'accounting & collections department',
                      'executive coach for emerging leaders',
                      'accounts receivable - coaching division'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in (
          "Financial Communications",
          "Payment Information",
          "Request to View Invoice"
        )
        and .confidence == "high"
)
and any(ml.nlu_classifier(body.current_thread.text).intents, .name == "bec")

Field Validations

Loading…

Comments (0)

Loading comments...