JobRecruitmentVariationRule

NOVA detection rule by Thomas Roccia · MIT

Detects requests for variations of job recruitment messages

rule JobRecruitmentVariationRule
{
    meta:
        description = "Detects requests for variations of job recruitment messages"
        author = "Thomas Roccia"
        version = "1.0.0"
        category = "abusing_functions/social_engineering"
        severity = "high"
        uuid = "6f67aa26-de86-4993-8a17-5168efba3ddf"
        date = "2026-02-21"
    
    keywords:
        $variation = "variation"
        $variations = "variations"
        $alternate = "alternate"
        $alternative = "alternative"
        $different = "different"
        $version = "version"
        $rewrite = "rewrite"
        $rephrase = "rephrase"
        $job = "job"
        $recruitment = "recruitment"
        $hiring = "hiring"
        $position = "position"
        $opportunity = "opportunity"
        $message = "message"
        $email = "email"
        $text = "text"
        $provide = "provide"
        $provided = "provided"
        $my = "my"
    
    semantics:
        $recruitment_variation = "requesting variations of job recruitment messages" (0.4)
        $potential_phishing = "possibly seeking help creating convincing recruitment phishing messages" (0.4)
    
    llm:
        $variation_check = "Determine if this query is requesting variations of an attacker-provided job recruitment message that could be used for social engineering" (0.8)
    
    condition:
        ($variation or $variations or $alternate or $alternative or $different or 
         $version or $rewrite or $rephrase) and
        ($job or $recruitment or $hiring or $position or $opportunity) and
        ($message or $email or $text) and
        ($provide or $provided or $my) and
        (any of semantics.*) and llm.$variation_check
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

705cd053-366f-4c27-9a83-de8558840543

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion