Fake voicemail notification (untrusted sender)

This rule detects a common credential phishing vector enticing the user to engage with links under the premise that they have a voicemail to retrieve. The rule looks for voicemail verbiage in the display name, body, subject or a combination of those elements with emojis or a medium to high credential theft NLU Intent from first-time + unsolicited sender.

Sublime rule (View on GitHub)

  1name: "Fake voicemail notification (untrusted sender)"
  2description: |
  3  This rule detects a common credential phishing vector enticing the user to engage with links under the premise that they have a voicemail to retrieve.
  4  The rule looks for voicemail verbiage in the display name, body, subject or a combination of those elements with emojis or a medium to high credential theft NLU Intent from first-time + unsolicited sender.  
  5type: "rule"
  6severity: "medium"
  7source: |
  8  type.inbound
  9  and length(body.links) < 5
 10  // voicemail related
 11  and (
 12    any([subject.subject, sender.display_name, ],
 13        regex.icontains(.,
 14                        '(voice|audio|call|missed|caii)(\s?|-)(mail|message|recording|call|caii)|transcription|open mp3|\([0-9]{3}\).(\*\*\*|[0-9]{3}).\*\*\*'
 15        )
 16        or regex.icontains(body.current_thread.text,
 17                           '(voice|audio|call|missed|caii)(\s?|-)(mail|message|recording|call|caii)|transcription|open mp3|\([0-9]{3}\).(\*\*\*|[0-9]{3}).\*\*\*'
 18        )
 19    )
 20  )
 21  and 2 of (
 22    (
 23      any(ml.nlu_classifier(body.current_thread.text).intents,
 24          .name in ("cred_theft") and .confidence in ("medium", "high")
 25      )
 26    ),
 27    (
 28      regex.icontains(sender.display_name,
 29                      '(voice|audio|call|missed|caii)(\s?|-)(mail|message|recording|call|caii)|transcription'
 30      )
 31    ),
 32    (
 33      length(body.current_thread.text) < 700
 34      and regex.icontains(body.current_thread.text, 'Méssãge|Méssage|Recéived|Addréss')
 35    ),
 36    (
 37      // sender domain matches no body domains
 38      all(body.links,
 39          .href_url.domain.root_domain != sender.email.domain.root_domain
 40          and .href_url.domain.root_domain not in $org_domains
 41          and .href_url.domain.root_domain not in (
 42            "unitelvoice.com",
 43            "googleapis.com",
 44            "dialmycalls.com",
 45            "ringcentral.biz"
 46          )
 47      )
 48    ),
 49    (
 50      any(body.links,
 51          regex.contains(.display_text, '[^a-z]*[A-Z][^a-z]*')
 52          and regex.icontains(.display_text,
 53                              '(voice|audio|call|missed|caii)(\s?|-)(mail|message|recording|call|caii)|transcription|open mp3'
 54          )
 55      )
 56    ),
 57    (
 58      any(body.links,
 59          network.whois(.href_url.domain).days_old < 10
 60          and not strings.icontains(.href_url.path, "unsubscribe")
 61      )
 62    ),
 63    (
 64      // recipient's SLD is in the sender's display name
 65      any(recipients.to,
 66          strings.icontains(sender.display_name, .email.domain.sld)
 67      )
 68    ),
 69    (
 70      any([sender.display_name, subject.subject],
 71          regex.contains(.,
 72                         '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
 73          )
 74      )
 75    ),
 76  )
 77  
 78  // negating legit replies and legitimate audio file attachments and known voicemail senders
 79  and sender.email.domain.root_domain not in (
 80    "magicjack.com",
 81    "unitelvoice.com",
 82    "voipinterface.net",
 83    "ringcentral.biz"
 84  )
 85  and not any(attachments, strings.starts_with(.content_type, "audio"))
 86  and not (
 87    (
 88      strings.istarts_with(subject.subject, "RE:")
 89      // out of office auto-reply
 90      // the NLU model will handle these better natively soon
 91      or strings.istarts_with(subject.subject, "Automatic reply:")
 92    )
 93    and (
 94      length(headers.references) > 0
 95      or any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
 96    )
 97  )
 98  and (
 99    (
100      profile.by_sender().prevalence in ("new", "outlier")
101      and not profile.by_sender().solicited
102    )
103    or (
104      profile.by_sender().any_messages_malicious_or_spam
105      and not profile.by_sender().any_false_positives
106    )
107  )  
108
109attack_types:
110  - "Credential Phishing"
111tactics_and_techniques:
112  - "Social engineering"
113detection_methods:
114  - "Content analysis"
115  - "Natural Language Understanding"
116  - "Sender analysis"
117  - "URL analysis"
118id: "74ba7787-e543-5ce8-b6eb-e1ecdb8f1d67"
to-top