Callback phishing via calendar invite

 1name: "Callback phishing via calendar invite"
 2description: "Detects calendar invites containing callback phishing language in the DESCRIPTION or SUMMARY of the invite."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(attachments) > 0
 8  and all(attachments, .content_type in ("text/calendar", "application/ics"))
 9  and any(attachments,
10          // extract the calendar invite summary or description and use NLU against it
11          any(file.explode(.),
12              any(.scan.ics.calendars,
13                  any(.components,
14                      any(ml.nlu_classifier(.summary).intents,
15                          .name == "callback_scam" and .confidence == "high"
16                      )
17                      or (
18                        any(ml.nlu_classifier(.description).intents,
19                            .name == "callback_scam"
20                        )
21                        or any(ml.nlu_classifier(strings.parse_html(.description).display_text
22                               ).intents,
23                               .name == "callback_scam"
24                        )
25                        or (
26                          any(ml.nlu_classifier(.description).topics,
27                              .name == "Request to View Invoice"
28                              and .confidence == "high"
29                          )
30                          // emoji regex
31                          and regex.contains(.description,
32                                             '[\x{1F600}-\x{1F64F}\x{1F300}-\x{1F5FF}\x{1F680}-\x{1F6FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{FE00}-\x{FE0F}\x{200D}\x{20E3}\x{E0020}-\x{E007F}]'
33                          )
34                        )
35                      )
36                  )
37              )
38          )
39  )
40  and (
41    not profile.by_sender_email().solicited
42    and not profile.by_sender_email().any_messages_benign
43  )
44  
45  // negate highly trusted sender domains unless they fail DMARC authentication
46  and (
47    (
48      sender.email.domain.root_domain in $high_trust_sender_root_domains
49      and not coalesce(headers.auth_summary.dmarc.pass, false)
50    )
51    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
52  )  
53attack_types:
54  - "Callback Phishing"
55tactics_and_techniques:
56  - "Social engineering"
57  - "Evasion"
58  - "ICS Phishing"
59detection_methods:
60  - "File analysis"
61  - "Header analysis"
62  - "Natural Language Understanding"
63  - "Sender analysis"
64id: "95c84360-d5a5-5396-b9ce-c61016cb178f"