Fake voicemail notification (untrusted sender)

calendar Apr 24, 2024  ·
Share on: linkedin copy

This rule detects a common credential phishing vector enticing the user to engage with links under the premise that they have a voicemail to retrieve. The rule looks for voicemail verbiage in the display name, body, subject or a combination of those elements with emojis or a medium to high credential theft NLU Intent from first-time + unsolicited sender.

Sublime rule (View on GitHub)

  1name: "Fake voicemail notification (untrusted sender)"
  2description: |
  3  This rule detects a common credential phishing vector enticing the user to engage with links under the premise that they have a voicemail to retrieve.
  4  The rule looks for voicemail verbiage in the display name, body, subject or a combination of those elements with emojis or a medium to high credential theft NLU Intent from first-time + unsolicited sender.  
  5type: "rule"
  6severity: "medium"
  7source: |
  8  type.inbound
  9  and length(body.links) < 5
 10  // voicemail related
 11  and (
 12    any([subject.subject, sender.display_name, ],
 13        regex.icontains(.,
 14                        '(voice|audio|call|missed|caii)(\s?|-)(mail|message|recording|call|caii)|transcription|open mp3|\([0-9]{3}\).(\*\*\*|[0-9]{3}).\*\*\*'
 15        )
 16        or regex.icontains(body.current_thread.text,
 17                           '(voice|audio|call|missed|caii)(\s?|-)(mail|message|recording|call|caii)|transcription|open mp3|\([0-9]{3}\).(\*\*\*|[0-9]{3}).\*\*\*'
 18        )
 19    )
 20  )
 21  and 2 of (
 22    (
 23      any(ml.nlu_classifier(body.current_thread.text).intents,
 24          .name in ("cred_theft") and .confidence in ("medium", "high")
 25      )
 26    ),
 27    (
 28      regex.icontains(sender.display_name,
 29                      '(voice|audio|call|missed|caii)(\s?|-)(mail|message|recording|call|caii)|transcription'
 30      )
 31    ),
 32    (
 33      length(body.current_thread.text) < 700
 34      and any([body.current_thread.text],
 35              regex.icontains(., 'Méssãge|Méssage|Recéived|Addréss')
 36      )
 37    ),
 38    (
 39      // sender domain matches no body domains
 40      all(body.links,
 41          .href_url.domain.root_domain != sender.email.domain.root_domain
 42          and .href_url.domain.root_domain not in $org_domains
 43          and .href_url.domain.root_domain not in (
 44            "unitelvoice.com",
 45            "googleapis.com",
 46            "dialmycalls.com",
 47            "ringcentral.biz"
 48          )
 49      )
 50    ),
 51    (
 52      any(body.links,
 53          regex.contains(.display_text, '[^a-z]*[A-Z][^a-z]*')
 54          and regex.icontains(.display_text,
 55                              '(voice|audio|call|missed|caii)(\s?|-)(mail|message|recording|call|caii)|transcription|open mp3'
 56          )
 57      )
 58    ),
 59    (
 60      any(body.links,
 61          beta.whois(.href_url.domain).days_old < 10
 62          and not strings.icontains(.href_url.path, "unsubscribe")
 63      )
 64    ),
 65    (
 66      // recipient's SLD is in the sender's display name
 67      any(recipients.to,
 68          strings.icontains(sender.display_name, .email.domain.sld)
 69      )
 70    ),
 71    (
 72      any([sender.display_name, subject.subject],
 73          regex.contains(.,
 74                         '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
 75          )
 76      )
 77    ),
 78  )
 79  
 80  // negating legit replies and legitimate audio file attachments and known voicemail senders
 81  and sender.email.domain.root_domain not in (
 82    "magicjack.com",
 83    "unitelvoice.com",
 84    "voipinterface.net",
 85    "ringcentral.biz"
 86  )
 87  and not any(attachments, strings.starts_with(.content_type, "audio"))
 88  and not (
 89    (
 90      strings.istarts_with(subject.subject, "RE:")
 91      // out of office auto-reply
 92      // the NLU model will handle these better natively soon
 93      or strings.istarts_with(subject.subject, "Automatic reply:")
 94    )
 95    and (
 96      length(headers.references) > 0
 97      or any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
 98    )
 99  )
100  and (
101    (
102      profile.by_sender().prevalence in ("new", "outlier")
103      and not profile.by_sender().solicited
104    )
105    or (
106      profile.by_sender().any_messages_malicious_or_spam
107      and not profile.by_sender().any_false_positives
108    )
109  )  
110
111attack_types:
112  - "Credential Phishing"
113tactics_and_techniques:
114  - "Social engineering"
115detection_methods:
116  - "Content analysis"
117  - "Natural Language Understanding"
118  - "Sender analysis"
119  - "URL analysis"
120id: "74ba7787-e543-5ce8-b6eb-e1ecdb8f1d67"
to-top