Service abuse: Microsoft with suspicious indicators in subject

calendar Jul 27, 2026  ·
Share on: linkedin copy

Detects messages impersonating Microsoft account verification that contain suspicious indicators in the subject line, including phone numbers, monetary amounts, suspicious domains, explicit content, or lengthy action-oriented phrases.

Sublime rule (View on GitHub)

 1name: "Service abuse: Microsoft with suspicious indicators in subject"
 2description: "Detects messages impersonating Microsoft account verification that contain suspicious indicators in the subject line, including phone numbers, monetary amounts, suspicious domains, explicit content, or lengthy action-oriented phrases."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  //
 8  //  Warning: This rule contains sexually explicit keywords
 9  //
10  and sender.email.domain.root_domain == "microsoftonline.com"
11  and strings.icontains(subject.subject, 'account email verification code')
12  and (
13    // phone number regex
14    regex.icontains(strings.replace_confusables(subject.base),
15                    '\+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
16                    '\+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}',
17                    '\(?[ilo0-9]{3}\)?[^ilo0-9]{0,3}\(?[ilo0-9]{3}\)?.?[ilo0-9]{4}'
18    )
19    // dollar amounts
20    or regex.icontains(subject.base, '(?:USD|\$)\s?\d')
21    or regex.icontains(subject.base, '\d+\.\d{2}\s?(?:USD|usd)')
22    // suspicious TLDs
23    or regex.icontains(subject.base,
24                       '\.(?:ac\.th|biz\.id|co\.(?:cl|id|za)|com\.(?:ge|py)|my\.id|ne\.jp|net\.ms|nom\.za|web\.id|accountants|am|app|ar|army|beauty|best|bet|bio|biz|bond|cam|cc|cf|cfd|chat|cl|click|cloud|club|cm|company|consulting|country|cricket|cyou|date|dev|digital|directory|domains|download|enterprises|es|expert|fashion|finance|fit|foo|free|fun|ga|gdn|gf|gq|gu|help|i2p|icu|il|ing|ink|ir|jetzt|kim|kz|lat|life|limited|link|live|loan|lol|ltd|ly|me|meme|men|ml|mom|monster|mov|mq|one|online|ooo|party|photos|pictures|pizza|press|pro|pub|pw|racing|re|ren|rest|review|ro|rsvp|ru|run|sale|sbs|science|shop|site|so|social|solutions|space|store|stream|su|sx|tech|tk|today|tokyo|top|trade|tt|ua|uno|us|vip|vu|wang|website|win|work|works|world|ws|xin|xyz|zip|zone)\b'
25    )
26    // dating/spam/explicit content lures
27    or regex.icontains(strings.replace_confusables(subject.base),
28                       '(?:\bs\s?e\s?x\b|horny|hook.?up|private room|wanna meet|wants to meet|naked|porn|webcam|nudes?|sexting|erotic|kinky|seduce|adult community|cam shows|local (?:girls?|women|single)|bed partner)'
29    )
30    // action verbs + length
31    or (
32      strings.count(subject.base, " ") > 8
33      and regex.icontains(strings.replace_confusables(subject.base),
34                          '(?:call|dial|speak to|contact \d|to (?:stop|void|reverse|confirm|secure|verify|unfreeze))'
35      )
36    )
37  )  
38attack_types:
39  - "Credential Phishing"
40  - "Spam"
41tactics_and_techniques:
42  - "Impersonation: Brand"
43  - "Social engineering"
44detection_methods:
45  - "Sender analysis"
46  - "Content analysis"
47id: "8967fec1-2664-5e5e-8f0f-063903ba68cd"
to-top