Create body_spouse_fake_call.yml

detection-rules/body_spouse_fake_call.yml

@@ -0,0 +1,26 @@
+name: "Body: Fake conversation with spouse mention and video call request"
+description: "Detects messages with fake thread history containing references to a spouse combined with requests for video calls using platforms like Zoom or Google Meet."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and length(body.previous_threads) >= 2
+  and strings.icontains(body.current_thread.text, "call")
+  and (
+    strings.icontains(body.current_thread.text, "wife and i")
+    or strings.icontains(body.current_thread.text, "husband and i")
+  )
+  and (
+    strings.icontains(body.current_thread.text, "zoom")
+    or strings.icontains(body.current_thread.text, "google meet")
+  )
+  and length(body.current_thread.text) < 1400
+
+attack_types:
+  - "BEC/Fraud"
+  - "Malware/Ransomware"
+tactics_and_techniques:
+  - "Social engineering"
+detection_methods:
+  - "Content analysis"
+id: "bd23f3b2-a1e5-5a7c-ab0c-c15d4c4458f5"