Added new rule for detecting rating solicitation scams

[jacob-mazurkiewicz]

Description

This new rule targets attempts for solicitation of ratings/reviews of employers. These false solicitations can contain malicious links or be attempts at phishing information or credentials from the receiver.

Associated samples

Example one:

Date: Thu, 15 May 2026 14:02:33 -0400
Subject: You've Been Selected - Rate Your Employer & Earn $500!
From: John Glennson <John@gl4ssdoor-reviews.com>
To: Jacob.Mazurkiewicz2@dcsg.com

Dear Valued Professional,

Congratulations! You have been specially selected to particpiate in our Annual Employer Review Program.

We are partnering with top companies to collect honest workplace feedback. As a token of our appreciation, you will receive a $500 gift card simply for completing a short review of your employer.

To claim your reward, please review your experience at your current workplace by clicking the link below:

https://gl4ssdoor-reviews.com/rate-employer?ref=29571

All you need to do is:
1. Rate your employer on a scale of 1-5
2. Share your review of your workplace experience
3. Verify your identity by entering your company email and password

Your feedback helps other job seekers make informed decisions. Leave a review today and your $500 gift card will be sent within 24 hours.

This offer expires in 48 hours so act now! Write a review before time runs out.

Important: To verify your eligibility and process your reward, we will need you to confirm your login credentials on the next page.

Thank you for helping us improve workplace transparency!

Best regards,
John Glennson
Glassdoor Ratings Department

Screenshot (insights)

Rule flagged example one

Rule flagged example two

[github-actions]

Test Rules Sync - Action Required

This PR was not automatically synced to test-rules because the author is not a member of the sublime-security organization.

To enable syncing, an organization member can comment /update-test-rules on this PR.

Once triggered, the rules will be synced on the next scheduled run (every 10 minutes).

[IndiaAce]

Hey Jacob thanks for your contribution!

I think this is a clever idea to provide coverage for these scams. Early telemetry looks okay, however I have a few suggestions (left below). Also, I'm curious to hear your thoughts on reinforcing the "scam" nature of these two examples you provided. I see some arrant false positives on some document sharing messages that are requests to view documents/proposals and leave feedback. They are no doubt malicious, but outside of the scope of this rule. I'm curious to see what the nlu classifier gives as a .topic for both of your samples? Perhaps the "giveaway" angle is something worth pursuing?

Keeping your .intent use for both current and previous threads, but adding another "and" stanza with something like
and any(ml.nlu_classifier(body.current_thread.text).topics, .name == "Advertising and Promotions" )

I also see some patterns (with some samples I found as well) where each of these seem to provide "instructions" to the user, notice your two samples contain that set of 4 instructions. That might be an angle worth pursuing.

Let me know your thoughts!

[IndiaAce]

Suggested change

	.name in ("scam", "job_scam", "cred_theft") and .confidence != "low"
	.name in ("job_scam", "cred_theft") and .confidence != "low"

"scam" is an invalid enumerator for our nlu_classifier, cred_theft and job_scam should grant us all the coverage you need here... you might consider "callback_scam" as well if you've seen samples!

[IndiaAce]

Suggested change

	// negating legitimate employer review/rating senders
	and not (
	sender.email.domain.root_domain in (
	'glassdoor.com',
	'indeed.com',
	'comparably.com',
	'greatplacetowork.com',
	'builtin.com',
	'linkedin.com',
	'lensa.com',
	'ziprecruiter.com',
	'kununu.com',
	'jobcase.com',
	'trustpilot.com'
	)
	and headers.auth_summary.dmarc.pass
	)
	// negating legitimate employer review/rating senders
	and not (
	(
	sender.email.domain.root_domain in (
	'comparably.com',
	'greatplacetowork.com',
	'builtin.com',
	'lensa.com',
	'ziprecruiter.com',
	'kununu.com',
	'jobcase.com',
	'trustpilot.com'
	)
	or sender.email.domain.root_domain in $high_trust_sender_root_domains
	)
	and coalesce(headers.auth_summary.dmarc.pass, false)
	)

A few of these domains are found in our high trust sender root domains, so I removed those and added a general check for those. Consider also strengthening the auth check to consider "null" values.

[IndiaAce]

Suggested change

	.name in ("scam", "job_scam", "cred_theft")
	.name in ("job_scam", "cred_theft")