Callback Phishing in body or attachment (untrusted sender)
Detects callback scams by analyzing text within images of receipts or invoices from untrusted senders.
Sublime rule (View on GitHub)
1name: "Callback Phishing in body or attachment (untrusted sender)"
2description: |
3 Detects callback scams by analyzing text within images of receipts or invoices from untrusted senders.
4type: "rule"
5severity: "medium"
6source: |
7 type.inbound
8 and length(attachments) < 5
9 and (
10 any(attachments,
11 (.file_type in $file_types_images or .file_type == "pdf")
12 and any(file.explode(.),
13
14 // exclude images taken with mobile cameras and screenshots from android
15 not any(.scan.exiftool.fields,
16 .key == "Model"
17 or (
18 .key == "Software"
19 and strings.starts_with(.value, "Android")
20 )
21 or (.key == "UserComment" and .value == "Screenshot")
22 )
23 and any(ml.nlu_classifier(.scan.ocr.raw).intents,
24 .name == "callback_scam" and .confidence == "high"
25 )
26 )
27 )
28 or any(ml.nlu_classifier(body.current_thread.text).intents,
29 .name in ("callback_scam")
30 and .confidence == "high"
31 and length(body.current_thread.text) < 1500
32 )
33 )
34 and not (
35 any(headers.domains, .domain == "smtp-out.gcp.bigcommerce.net")
36 and strings.icontains(body.html.raw, "bigcommerce.com")
37 )
38 and (
39 (
40 profile.by_sender().prevalence in ("new", "outlier")
41 and not profile.by_sender().solicited
42 )
43 or (
44 profile.by_sender().any_messages_malicious_or_spam
45 and not profile.by_sender().any_false_positives
46 )
47 )
48
49 // negate highly trusted sender domains unless they fail DMARC authentication
50 and (
51 (
52 sender.email.domain.root_domain in $high_trust_sender_root_domains
53 and not headers.auth_summary.dmarc.pass
54 )
55 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
56 )
57
58
59attack_types:
60 - "Callback Phishing"
61tactics_and_techniques:
62 - "Out of band pivot"
63 - "Social engineering"
64detection_methods:
65 - "Content analysis"
66 - "File analysis"
67 - "Optical Character Recognition"
68 - "Natural Language Understanding"
69 - "Sender analysis"
70id: "b93c6f94-c9a3-587a-8eb5-6856754f8222"