Callback Phishing solicitation in message body
A fraudulent invoice/receipt found in the body of the message. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.
Sublime rule (View on GitHub)
1name: "Callback Phishing solicitation in message body"
2description: |
3 A fraudulent invoice/receipt found in the body of the message.
4 Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number.
5 The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.
6type: "rule"
7severity: "medium"
8source: |
9 type.inbound
10 and length(attachments) == 0
11 and (
12 not profile.by_sender().solicited
13 or (
14 profile.by_sender().any_messages_malicious_or_spam
15 and not profile.by_sender().any_false_positives
16 )
17 )
18 and (
19 sender.email.domain.root_domain in $free_email_providers
20 or sender.email.domain.tld in $suspicious_tlds
21 or network.whois(sender.email.domain).found == false
22 or headers.mailer in~ ("Microsoft CDO for Windows 2000")
23 or (
24 length(recipients.to) == 1
25 and all(recipients.to, .email.domain.domain not in $org_domains)
26 )
27 )
28 and (
29 // this section is synced with attachment_callback_phish_with_pdf.yml and attachment_callback_phish_with_img.yml
30 regex.icontains(body.current_thread.text,
31 '(p.{0,3}a.{0,3}y.{0,3}p.{0,3}a.{0,3}l|ma?c.?fee|n[o0]rt[o0]n|geek.{0,5}squad|ebay|symantec|best buy|lifel[o0]c|secure anywhere|starz|utilities premium|pc security|at&t)'
32 )
33 or any(ml.logo_detect(beta.message_screenshot()).brands,
34 .name in ("PayPal", "Norton", "GeekSquad", "Ebay", "McAfee", "AT&T")
35 )
36 )
37 and length(body.current_thread.text) < 1750
38 and (
39 (
40 // this seciton is synced with attachment_callback_phish_with_img.yml and attachment_callback_phish_with_pdf.yml
41 // however, the 3 of logic and requiring a phone number is specific to this rule in order to reduce FPs
42 // caused by messages which mention cancelling or otherwise managing a subscription
43 // it is also synced and below for message_screenshot OCR output
44 3 of (
45 strings.icontains(body.current_thread.text, 'purchase'),
46 strings.icontains(body.current_thread.text, 'payment'),
47 strings.icontains(body.current_thread.text, 'transaction'),
48 strings.icontains(body.current_thread.text, 'subscription'),
49 strings.icontains(body.current_thread.text, 'antivirus'),
50 strings.icontains(body.current_thread.text, 'order'),
51 strings.icontains(body.current_thread.text, 'support'),
52 strings.icontains(body.current_thread.text, 'help line'),
53 strings.icontains(body.current_thread.text, 'receipt'),
54 strings.icontains(body.current_thread.text, 'invoice'),
55 strings.icontains(body.current_thread.text, 'call'),
56 strings.icontains(body.current_thread.text, 'cancel'),
57 strings.icontains(body.current_thread.text, 'renew'),
58 strings.icontains(body.current_thread.text, 'refund'),
59 regex.icontains(body.current_thread.text, "(?:reach|contact) us at"),
60 strings.icontains(body.current_thread.text, "+1"),
61 strings.icontains(body.current_thread.text, "amount"),
62 strings.icontains(body.current_thread.text, "charged"),
63 strings.icontains(body.current_thread.text, "crypto"),
64 strings.icontains(body.current_thread.text, "wallet address"),
65 regex.icontains(body.current_thread.text, '\$\d{3}\.\d{2}\b'),
66 )
67 // phone number regex
68 and regex.icontains(body.current_thread.text,
69 '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
70 '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
71 )
72 )
73 or (
74 any(file.explode(beta.message_screenshot()),
75 // this seciton is synced with attachment_callback_phish_with_img.yml and attachment_callback_phish_with_pdf.yml
76 // and above for current_thread.text
77 3 of (
78 strings.icontains(.scan.ocr.raw, 'purchase'),
79 strings.icontains(.scan.ocr.raw, 'payment'),
80 strings.icontains(.scan.ocr.raw, 'transaction'),
81 strings.icontains(.scan.ocr.raw, 'subscription'),
82 strings.icontains(.scan.ocr.raw, 'antivirus'),
83 strings.icontains(.scan.ocr.raw, 'order'),
84 strings.icontains(.scan.ocr.raw, 'support'),
85 strings.icontains(.scan.ocr.raw, 'help line'),
86 strings.icontains(.scan.ocr.raw, 'receipt'),
87 strings.icontains(.scan.ocr.raw, 'invoice'),
88 strings.icontains(.scan.ocr.raw, 'call'),
89 strings.icontains(.scan.ocr.raw, 'helpdesk'),
90 strings.icontains(.scan.ocr.raw, 'cancel'),
91 strings.icontains(.scan.ocr.raw, 'renew'),
92 strings.icontains(.scan.ocr.raw, 'refund'),
93 regex.icontains(.scan.ocr.raw, "(?:reach|contact) us at"),
94 strings.icontains(.scan.ocr.raw, '+1'),
95 strings.icontains(.scan.ocr.raw, 'amount'),
96 strings.icontains(.scan.ocr.raw, 'charged'),
97 strings.icontains(.scan.ocr.raw, 'crypto'),
98 strings.icontains(.scan.ocr.raw, 'wallet address'),
99 regex.icontains(.scan.ocr.raw, '\$\d{3}\.\d{2}\b'),
100 )
101 // phone number regex
102 and regex.icontains(.scan.ocr.raw,
103 '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
104 '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
105 )
106
107 // negate messages with previous threads. While callback phishing with thread hijacking or with current_thread
108 // padded with whitespace and previous threads in the message has been observed, the intetion of using OCR is for image embedded callbacks
109 and not regex.icount(.scan.ocr.raw, '(?:from|to|sent|date|cc|subject):') > 3
110 // this notation of previous threads often only occurs once
111 and not regex.icontains(.scan.ocr.raw, 'wrote:[\r\n]')
112 )
113 )
114 )
115 // not high trust sender domains
116 and (
117 (
118 sender.email.domain.root_domain in $high_trust_sender_root_domains
119 and not headers.auth_summary.dmarc.pass
120 )
121 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
122 )
123 and not strings.ends_with(headers.message_id, "@shopify.com>")
124attack_types:
125 - "Callback Phishing"
126tactics_and_techniques:
127 - "Free email provider"
128 - "Impersonation: Brand"
129 - "Out of band pivot"
130 - "Social engineering"
131detection_methods:
132 - "File analysis"
133 - "Sender analysis"
134id: "10a3a446-c70f-5843-a4e4-4d815d33fcb1"