Service abuse: Arketa notification callback scam

 1name: "Service abuse: Arketa notification callback scam"
 2description: "Detects messages sent from Arketa's notification address (no-reply@notifications.arketa.co) that has been abused to deliver callback scam content. The rule flags messages where an NLU classifier identifies callback scam intent, or where the body references well-known brands (e.g., McAfee, Norton, PayPal, eBay, Best Buy) alongside scam-related keywords (purchase, invoice, refund, cancel, etc.) and includes a phone number formatted to evade detection through character substitution or spacing tricks."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.email == "no-reply@notifications.arketa.co"
 8  and (
 9    any(ml.nlu_classifier(body.current_thread.text).intents,
10        .name == "callback_scam" and .confidence != "low"
11    )
12    or (
13      regex.icontains(body.current_thread.text,
14                      (
15                        "mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck"
16                      )
17      )
18      and (
19        3 of (
20          strings.ilike(body.current_thread.text, '*purchase*'),
21          strings.ilike(body.current_thread.text, '*payment*'),
22          strings.ilike(body.current_thread.text, '*transaction*'),
23          strings.ilike(body.current_thread.text, '*subscription*'),
24          strings.ilike(body.current_thread.text, '*antivirus*'),
25          strings.ilike(body.current_thread.text, '*order*'),
26          strings.ilike(body.current_thread.text, '*support*'),
27          strings.ilike(body.current_thread.text, '*receipt*'),
28          strings.ilike(body.current_thread.text, '*invoice*'),
29          strings.ilike(body.current_thread.text, '*call*'),
30          strings.ilike(body.current_thread.text, '*cancel*'),
31          strings.ilike(body.current_thread.text, '*renew*'),
32          strings.ilike(body.current_thread.text, '*refund*'),
33          strings.ilike(body.current_thread.text, '*host key*')
34        )
35      )
36      // phone number regex
37      and any([body.current_thread.text, subject.subject],
38              regex.icontains(strings.replace_confusables(.),
39                              '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
40                              '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}',
41                              '[\+\x{FF0B}]?(?:\p{N}[^\p{N}]{0,3}){10,11}'
42              )
43      )
44    )
45  )  
46attack_types:
47  - "Callback Phishing"
48tactics_and_techniques:
49  - "Social engineering"
50  - "Impersonation: Brand"
51  - "Evasion"
52  - "Out of band pivot"
53detection_methods:
54  - "Natural Language Understanding"
55  - "Content analysis"
56  - "Sender analysis"
57id: "d254019b-9120-571d-9baa-e4d13407fa23"