Email Containing Civil ID Information - Kuwait Civil ID Detection

Ali AlEnezi@site

•updated Apr 3, 2026•3•0•140

This rule detects emails that contain keywords related to 'civil id' in English or Arabic and subsequently extract potential Civil ID numbers from the email body. It then validates the extracted numbers based on birth month and day, and categorizes the risk level based on sender's domain and attachment count. This could indicate data exfiltration or sensitive information exposure.