Callback Phishing solicitation in message body

  1name: "Callback Phishing solicitation in message body"
  2description: |
  3  A fraudulent invoice/receipt found in the body of the message.
  4  Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. 
  5  The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.  
  6type: "rule"
  7severity: "medium"
  8source: |
  9  type.inbound
 10  and length(attachments) == 0
 11  and (
 12    not profile.by_sender().solicited
 13    or (
 14      profile.by_sender().any_messages_malicious_or_spam
 15      and not profile.by_sender().any_false_positives
 16    )
 17  )
 18  and (
 19    sender.email.domain.root_domain in $free_email_providers
 20    or sender.email.domain.tld in $suspicious_tlds
 21    or network.whois(sender.email.domain).found == false
 22    or headers.mailer in~ ("Microsoft CDO for Windows 2000")
 23    or (
 24      length(recipients.to) == 1
 25      and all(recipients.to, .email.domain.domain not in $org_domains)
 26    )
 27  )
 28  and (
 29    // this section is synced with attachment_callback_phish_with_pdf.yml and attachment_callback_phish_with_img.yml
 30    regex.icontains(body.current_thread.text,
 31                    '(p.{0,3}a.{0,3}y.{0,3}p.{0,3}a.{0,3}l|ma?c.?fee|n[o0]rt[o0]n|geek.{0,5}squad|ebay|symantec|best buy|lifel[o0]c|secure anywhere|starz|utilities premium|pc security|at&t)'
 32    )
 33    or any(ml.logo_detect(beta.message_screenshot()).brands,
 34           .name in ("PayPal", "Norton", "GeekSquad", "Ebay", "McAfee", "AT&T")
 35    )
 36  )
 37  and length(body.current_thread.text) < 1750
 38  and (
 39    (
 40      // this seciton is synced with attachment_callback_phish_with_img.yml and attachment_callback_phish_with_pdf.yml
 41      // however, the 3 of logic and requiring a phone number is specific to this rule in order to reduce FPs
 42      // caused by messages which mention cancelling or otherwise managing a subscription
 43      // it is also synced and below for message_screenshot OCR output
 44      3 of (
 45        strings.icontains(body.current_thread.text, 'purchase'),
 46        strings.icontains(body.current_thread.text, 'payment'),
 47        strings.icontains(body.current_thread.text, 'transaction'),
 48        strings.icontains(body.current_thread.text, 'subscription'),
 49        strings.icontains(body.current_thread.text, 'antivirus'),
 50        strings.icontains(body.current_thread.text, 'order'),
 51        strings.icontains(body.current_thread.text, 'support'),
 52        strings.icontains(body.current_thread.text, 'help line'),
 53        strings.icontains(body.current_thread.text, 'receipt'),
 54        strings.icontains(body.current_thread.text, 'invoice'),
 55        strings.icontains(body.current_thread.text, 'call'),
 56        strings.icontains(body.current_thread.text, 'cancel'),
 57        strings.icontains(body.current_thread.text, 'renew'),
 58        strings.icontains(body.current_thread.text, 'refund'),
 59        regex.icontains(body.current_thread.text, "(?:reach|contact) us at"),
 60        strings.icontains(body.current_thread.text, "+1"),
 61        strings.icontains(body.current_thread.text, "amount"),
 62        strings.icontains(body.current_thread.text, "charged"),
 63        strings.icontains(body.current_thread.text, "crypto"),
 64        strings.icontains(body.current_thread.text, "wallet address"),
 65        regex.icontains(body.current_thread.text, '\$\d{3}\.\d{2}\b'),
 66      )
 67      // phone number regex
 68      and regex.icontains(body.current_thread.text,
 69                          '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
 70                          '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
 71      )
 72    )
 73    or (
 74      any(file.explode(beta.message_screenshot()),
 75          // this seciton is synced with attachment_callback_phish_with_img.yml and attachment_callback_phish_with_pdf.yml
 76          // and above for current_thread.text
 77          3 of (
 78            strings.icontains(.scan.ocr.raw, 'purchase'),
 79            strings.icontains(.scan.ocr.raw, 'payment'),
 80            strings.icontains(.scan.ocr.raw, 'transaction'),
 81            strings.icontains(.scan.ocr.raw, 'subscription'),
 82            strings.icontains(.scan.ocr.raw, 'antivirus'),
 83            strings.icontains(.scan.ocr.raw, 'order'),
 84            strings.icontains(.scan.ocr.raw, 'support'),
 85            strings.icontains(.scan.ocr.raw, 'help line'),
 86            strings.icontains(.scan.ocr.raw, 'receipt'),
 87            strings.icontains(.scan.ocr.raw, 'invoice'),
 88            strings.icontains(.scan.ocr.raw, 'call'),
 89            strings.icontains(.scan.ocr.raw, 'helpdesk'),
 90            strings.icontains(.scan.ocr.raw, 'cancel'),
 91            strings.icontains(.scan.ocr.raw, 'renew'),
 92            strings.icontains(.scan.ocr.raw, 'refund'),
 93            regex.icontains(.scan.ocr.raw, "(?:reach|contact) us at"),
 94            strings.icontains(.scan.ocr.raw, '+1'),
 95            strings.icontains(.scan.ocr.raw, 'amount'),
 96            strings.icontains(.scan.ocr.raw, 'charged'),
 97            strings.icontains(.scan.ocr.raw, 'crypto'),
 98            strings.icontains(.scan.ocr.raw, 'wallet address'),
 99            regex.icontains(.scan.ocr.raw, '\$\d{3}\.\d{2}\b'),
100          )
101          // phone number regex
102          and regex.icontains(.scan.ocr.raw,
103                              '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
104                              '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
105          )
106  
107          // negate messages with previous threads.  While callback phishing with thread hijacking or with current_thread 
108          // padded with whitespace and previous threads in the message has been observed, the intetion of using OCR is for image embedded callbacks
109          and not regex.icount(.scan.ocr.raw, '(?:from|to|sent|date|cc|subject):') > 3
110          // this notation of previous threads often only occurs once
111          and not regex.icontains(.scan.ocr.raw, 'wrote:[\r\n]')
112      )
113    )
114  )
115  // not high trust sender domains
116  and (
117    (
118      sender.email.domain.root_domain in $high_trust_sender_root_domains
119      and not headers.auth_summary.dmarc.pass
120    )
121    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
122  )
123  and not strings.ends_with(headers.message_id, "@shopify.com>")  
124attack_types:
125  - "Callback Phishing"
126tactics_and_techniques:
127  - "Free email provider"
128  - "Impersonation: Brand"
129  - "Out of band pivot"
130  - "Social engineering"
131detection_methods:
132  - "File analysis"
133  - "Sender analysis"
134id: "10a3a446-c70f-5843-a4e4-4d815d33fcb1"