Service abuse: Target shipping notification callback scam

 1name: "Service abuse: Target shipping notification callback scam"
 2description: "Detects inbound emails spoofed from Target's domain that contain a shipping address block with a suspiciously formatted zip code and phone number, indicating the legitimate service is being leveraged to deliver a callback scam lure."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and sender.email.email == "orders@oe1.target.com"
 8  and any(map(html.xpath(body.html, '//h1[contains(@class,"ship-address")]/span').nodes,
 9              .display_text
10          ),
11          regex.icontains(., '[a-z]{2}\s[ilo0-9]{5}(?:-[ilo0-9]{4})?\s*$')
12          and regex.icontains(.,
13                              '\+?(?:[ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
14                              '\+?(?:[ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
15          )
16  )  
17attack_types:
18  - "Credential Phishing"
19  - "Spam"
20tactics_and_techniques:
21  - "Impersonation: Brand"
22  - "Evasion"
23  - "Spoofing"
24  - "Social engineering"
25detection_methods:
26  - "HTML analysis"
27  - "Content analysis"
28  - "Sender analysis"
29id: "ac2279f8-caec-5f93-8c9c-b9a84b3e2450"