Service abuse: Spotify callback scam notification

 1name: "Service abuse: Spotify callback scam notification"
 2description: "Detects inbound emails sent from Spotify's legitimate no-reply address where the greeting text preceding the standard 'Welcome back to Spotify' message is classified as callback scam content, indicating the genuine notification template has been abused to deliver scam instructions."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.email == "no-reply@spotify.com"
 8  and any(regex.iextract(body.current_thread.text,
 9                         '(?P<greeting>[^\n]+)\nWelcome back to Spotify'
10          ),
11          any(ml.nlu_classifier(.named_groups['greeting']).intents,
12              .name == "callback_scam"
13          )
14  )  
15attack_types:
16  - "Callback Phishing"
17tactics_and_techniques:
18  - "Social engineering"
19detection_methods:
20  - "Natural Language Understanding"
21  - "Sender analysis"
22  - "Content analysis"
23id: "530cfa58-80b2-57a2-b223-5959d518de76"