rule_id: R0047
rule_version: 1
name: bec_pattern
description: |
  Business email compromise: urgent-wire / CEO-impersonation
  language + a request-for-action shape (gift cards, wire,
  payroll change). Subject + body composite signal.
applies_to:
  - email
match:
  kind: lifter:email_bec
  subject_keywords:
    - urgent
    - wire
    - invoice
    - payroll
    - gift card
  body_action_keywords:
    - send
    - transfer
    - update banking
    - confidential
emits:
  - tactic: TA0001
    technique_id: T1566
    sub_technique_id: T1566.003
    confidence: 0.85
evidence_fields:
  - subject
  - matched_subject_kw
  - matched_body_kw