Exec impersonation email from external sender with urgency/secrecy language

Arnold Chan@slaz

•updated Sep 10, 2026•0•0•2

Detects inbound emails originating from external, non-corporate domains that impersonate an internal executive's display name. The rule flags messages containing common Business Email Compromise (BEC) urgency or confidentiality triggers such as 'wire transfer', 'urgent', 'NDA', or 'private email'.