Service abuse: Microsoft Power Apps callback scam

calendar Oct 2, 2026  ·
Share on: linkedin copy

Detects callback scam messages sent through Microsoft Power Apps that impersonate well-known brands like McAfee, Norton, Geek Squad, PayPal, or other services, containing suspicious transaction-related language and phone numbers to solicit victim contact.

Sublime rule (View on GitHub)

 1name: "Service abuse: Microsoft Power Apps callback scam"
 2description: "Detects callback scam messages sent through Microsoft Power Apps that impersonate well-known brands like McAfee, Norton, Geek Squad, PayPal, or other services, containing suspicious transaction-related language and phone numbers to solicit victim contact."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.email in (
 8    "powerapps-noreply@microsoft.com",
 9    "microsoft@powerapps.com"
10  )
11  // phone number regex required
12  and any([body.current_thread.text, subject.subject],
13          regex.icontains(.,
14                          '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
15                          '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
16          )
17  )
18  and (
19    any(ml.nlu_classifier(body.current_thread.text).intents,
20        .name == "callback_scam" and .confidence != "low"
21    )
22    or (
23      regex.icontains(body.current_thread.text,
24                      (
25                        "mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck"
26                      )
27      )
28      and (
29        3 of (
30          strings.ilike(body.current_thread.text, '*purchase*'),
31          strings.ilike(body.current_thread.text, '*payment*'),
32          strings.ilike(body.current_thread.text, '*transaction*'),
33          strings.ilike(body.current_thread.text, '*subscription*'),
34          strings.ilike(body.current_thread.text, '*antivirus*'),
35          strings.ilike(body.current_thread.text, '*order*'),
36          strings.ilike(body.current_thread.text, '*support*'),
37          strings.ilike(body.current_thread.text, '*receipt*'),
38          strings.ilike(body.current_thread.text, '*invoice*'),
39          strings.ilike(body.current_thread.text, '*call*'),
40          strings.ilike(body.current_thread.text, '*cancel*'),
41          strings.ilike(body.current_thread.text, '*renew*'),
42          strings.ilike(body.current_thread.text, '*refund*'),
43          strings.ilike(body.current_thread.text, '*host key*')
44        )
45      )
46    )
47  )  
48attack_types:
49  - "Callback Phishing"
50tactics_and_techniques:
51  - "Impersonation: Brand"
52  - "Out of band pivot"
53  - "Social engineering"
54detection_methods:
55  - "Content analysis"
56  - "Natural Language Understanding"
57  - "Sender analysis"
58id: "ec6faebb-ecf3-5fd3-9bed-aa6d0ffefa2b"
to-top