[PR #3344] added rule: Spam: Meta Social Media Marketing

Author: github-actions[bot]

detection-rules/3344_spam_meta_social_marketing.yml

@@ -0,0 +1,21 @@
+name: "Spam: Meta Social Media Marketing"
+description: "This rule detects spam related to offering Meta (Facebook) social media marketing. The messages typically offers a certification using a coursera course."
+type: "rule"
+severity: "low"
+source: |
+  type.inbound
+  and any(recipients.to, 
+      strings.icontains(body.current_thread.text, strings.concat("Dear ", .email.email))
+  )
+  and strings.icontains(body.current_thread.text, "Meta") and strings.icontains(body.current_thread.text, "Social Media Marketing")
+
+tags:
+  - "Attack surface reduction"
+attack_types:
+  - "Spam"
+detection_methods:
+  - "Content analysis"
+id: "82c31fcc-38d5-58ea-80d7-11942f01b407"
+og_id: "a0a1b464-8374-599b-b47a-4af867da28b0"
+testing_pr: 3344
+testing_sha: 64b0e6e1539b7f53a9d5e210791ede2a4b175b63