Callback Scam: Outlook groups

calendar Aug 27, 2026  ·
Share on: linkedin copy

Detects inbound messages sent to Outlook group distribution lists (groups.outlook.com) where the body text is classified with high confidence as callback scam intent by an NLU model, while excluding cases where recipient lists are empty or entirely invalid.

Sublime rule (View on GitHub)

 1name: "Callback Scam: Outlook groups"
 2description: "Detects inbound messages sent to Outlook group distribution lists (groups.outlook.com) where the body text is classified with high confidence as callback scam intent by an NLU model, while excluding cases where recipient lists are empty or entirely invalid."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and all(recipients.to, .email.domain.domain == "groups.outlook.com")
 8  and any(ml.nlu_classifier(body.current_thread.text).intents,
 9          .name == "callback_scam" and .confidence == "high"
10  )
11  and not (
12    length(recipients.to) == 0 or all(recipients.to, .email.domain.valid == false)
13  )  
14attack_types:
15  - "Callback Phishing"
16tactics_and_techniques:
17  - "Social engineering"
18detection_methods:
19  - "Natural Language Understanding"
20  - "Header analysis"
21id: "e8775a29-c10d-5b02-825f-8baa5112e57f"
to-top