Spam: Suspicious toll-free phone number

 1name: "Spam: Suspicious toll-free phone number"
 2description: "Detects messages containing phone numbers 1 800-555-0199 or 1 800-555-0299 in the subject or body, which is reserved for use by the entertainment industry. Commonly used as a placeholder phone number in LLM-generated campaigns."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and any([body.current_thread.text, subject.subject],
 8          regex.icontains(., '\b\+?(\d{1}.)?\(?8\d{2}?\)?.555.?0[12]99\b')
 9  )  
10tags:
11 - "Attack surface reduction"
12attack_types:
13  - "Spam"
14tactics_and_techniques:
15  - "Social engineering"
16detection_methods:
17  - "Content analysis"
18id: "d9766109-6574-5fd8-9c07-d606d3ce82d2"