Attachment: Callback phishing solicitation via pdf file
A fraudulent invoice/receipt found in a pdf attachment. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.
Sublime rule (View on GitHub)
1name: "Attachment: Callback phishing solicitation via pdf file"
2description: |
3 A fraudulent invoice/receipt found in a pdf attachment.
4 Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number.
5 The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.
6type: "rule"
7severity: "high"
8source: |
9 type.inbound
10 and (
11 not profile.by_sender().solicited
12 or (
13 profile.by_sender().any_messages_malicious_or_spam
14 and not profile.by_sender().any_messages_benign
15 )
16 )
17
18 // single attachment
19 and length(attachments) == 1
20
21 // sender is freemail
22 and (
23 sender.email.domain.root_domain in $free_email_providers
24 // the sender is a common service, which has likely been sent through a DL
25 or (
26 sender.email.domain.root_domain in $tranco_50k
27 and all(recipients.to, .email.domain.domain not in $org_domains)
28 )
29 )
30
31 // negate ML matches to "Professional and Career Development" - tuning resume FPs
32 and not any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).topics,
33 .name == "Professional and Career Development"
34 and .confidence == "high"
35 )
36 and not any(attachments,
37 .file_type == 'pdf'
38 and any(file.explode(.),
39 any(ml.nlu_classifier(.scan.ocr.raw).topics,
40 .name == "Professional and Career Development"
41 and .confidence == "high"
42 )
43 )
44 )
45
46 // the attachment is a pdf with less than 3 pages, and at least 60 ocr chars
47 and any(attachments,
48 (
49 .file_extension == "pdf"
50 // get the length of the attached pdf
51 and any(file.explode(.),
52 .depth == 0
53 and .scan.exiftool.page_count < 3
54 and (
55 not (
56 strings.istarts_with(.scan.exiftool.producer,
57 "Aspose.Words for Java"
58 )
59 and (
60 .scan.exiftool.creator == "Anusha T"
61 or any(.scan.exiftool.fields,
62 .key == "Author" and .value == "Anusha T"
63 )
64 )
65 )
66 or .scan.exiftool.producer is null
67 or .scan.exiftool.creator is null
68 )
69 )
70 // check that any _single_ result in the file.explode matches these conditions
71 // a second file.explode is required because the OCR is generated at a different depth within
72 // the file.explode results
73 and (
74 any(file.explode(.),
75 length(.scan.ocr.raw) > 60
76 // 4 of the following strings are found
77 and 4 of (
78 // this section is synced with attachment_callback_phish_with_pdf.yml and body_callback_phishing_no_attachment.yml
79 strings.icontains(.scan.ocr.raw, "purchase"),
80 strings.icontains(.scan.ocr.raw, "payment"),
81 strings.icontains(.scan.ocr.raw, "transaction"),
82 strings.icontains(.scan.ocr.raw, "subscription"),
83 strings.icontains(.scan.ocr.raw, "antivirus"),
84 strings.icontains(.scan.ocr.raw, "order"),
85 strings.icontains(.scan.ocr.raw, "support"),
86 strings.icontains(.scan.ocr.raw, "help line"),
87 strings.icontains(.scan.ocr.raw, "receipt"),
88 strings.icontains(.scan.ocr.raw, "invoice"),
89 strings.icontains(.scan.ocr.raw, "call"),
90 strings.icontains(.scan.ocr.raw, "helpdesk"),
91 strings.icontains(.scan.ocr.raw, "cancel"),
92 strings.icontains(.scan.ocr.raw, "renew"),
93 strings.icontains(.scan.ocr.raw, "refund"),
94 regex.icontains(.scan.ocr.raw, "(?:reach|contact) us at"),
95 strings.icontains(.scan.ocr.raw, "+1"),
96 strings.icontains(.scan.ocr.raw, "amount"),
97 strings.icontains(.scan.ocr.raw, "charged"),
98 strings.icontains(.scan.ocr.raw, "crypto"),
99 strings.icontains(.scan.ocr.raw, "wallet address"),
100 regex.icontains(.scan.ocr.raw, '\$\d{3}\.\d{2}\b'),
101 regex.icontains(.scan.ocr.raw,
102 '(\+[ilo0-9]|1.(\()?[ilo0-9]{3}(\))?\D[ilo0-9]{3}\D[ilo0-9]{4})',
103 '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
104 ),
105 )
106 and (
107 // this section is synced with attachment_callback_phish_with_img.yml and body_callback_phishing_no_attachment.yml
108 regex.icontains(.scan.ocr.raw,
109 '(p.{0,3}a.{0,3}y.{0,3}p.{0,3}a.{0,3}l|ma?c.?fee|n[o0]rt[o0]n|geek.{0,5}squad|ebay|symantec|best buy|lifel[o0]c|secure anywhere|starz|utilities premium|pc security|at&t)'
110 )
111 // suspicious attachment name from the attachment object not file.explode() output
112 or regex.icontains(..file_name, 'INV(?:_|\s)?\d+(.pdf)$')
113 )
114 // Negate bank statements
115 and not (
116 2 of (
117 strings.icontains(.scan.ocr.raw, "opening balance"),
118 strings.icontains(.scan.ocr.raw, "closing balance"),
119 strings.icontains(.scan.ocr.raw, "direct debit"),
120 strings.icontains(.scan.ocr.raw, "interest"),
121 strings.icontains(.scan.ocr.raw, "account balance"),
122 )
123 )
124 )
125 // this section is synced with attachment_callback_phish_with_img.yml and body_callback_phishing_no_attachment.yml
126 or any(ml.logo_detect(.).brands,
127 .name in (
128 "PayPal",
129 "Norton",
130 "GeekSquad",
131 "Ebay",
132 "McAfee",
133 "AT&T"
134 )
135 )
136 )
137 )
138 )
139 and (
140 (
141 (length(headers.references) > 0 or headers.in_reply_to is null)
142 and not (
143 (
144 strings.istarts_with(subject.subject, "RE:")
145 or strings.istarts_with(subject.subject, "RES:")
146 or strings.istarts_with(subject.subject, "R:")
147 or strings.istarts_with(subject.subject, "ODG:")
148 or strings.istarts_with(subject.subject, "答复:")
149 or strings.istarts_with(subject.subject, "AW:")
150 or strings.istarts_with(subject.subject, "TR:")
151 or strings.istarts_with(subject.subject, "FWD:")
152 or regex.imatch(subject.subject,
153 '(\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.*'
154 )
155 )
156 )
157 )
158 or (length(headers.references) == 0 or length(body.current_thread.text) < 10)
159 )
160attack_types:
161 - "Callback Phishing"
162tactics_and_techniques:
163 - "Evasion"
164 - "Free email provider"
165 - "Out of band pivot"
166 - "PDF"
167 - "Social engineering"
168detection_methods:
169 - "Exif analysis"
170 - "File analysis"
171 - "Optical Character Recognition"
172 - "Sender analysis"
173id: "ac33f097-af20-554c-b29a-56f21be1b285"