Sublime Security medium experimental mql

Callback phishing via Yammer comment

Detects callback scams sent through Yammer infrastructure containing suspicious payment-related keywords and phone numbers. The rule identifies messages with callback scam language patterns or multiple financial transaction terms combined with phone number patterns in the message body or subject line.

View Source

Detection Logic

type.inbound
// message from Yammer sending infratructure
and sender.email.domain.root_domain == 'yammer.com'
and length(body.current_thread.text) < 2000

// Callback Phishing
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name in ("callback_scam") and .confidence in ("medium", "high")
  )
  or 3 of (
    strings.ilike(body.current_thread.text, '*purchase*'),
    strings.ilike(body.current_thread.text, '*payment*'),
    strings.ilike(body.current_thread.text, '*transaction*'),
    strings.ilike(body.current_thread.text, '*subscription*'),
    strings.ilike(body.current_thread.text, '*antivirus*'),
    strings.ilike(body.current_thread.text, '*order*'),
    strings.ilike(body.current_thread.text, '*support*'),
    strings.ilike(body.current_thread.text, '*help line*'),
    strings.ilike(body.current_thread.text, '*receipt*'),
    strings.ilike(body.current_thread.text, '*invoice*'),
    strings.ilike(body.current_thread.text, '*call*'),
    strings.ilike(body.current_thread.text, '*cancel*'),
    strings.ilike(body.current_thread.text, '*renew*'),
    strings.ilike(body.current_thread.text, '*refund*')
  )
)
// phone number regex
and any([body.current_thread.text, subject.subject],
        regex.icontains(.,
                        '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                        '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
        )
)
// negate benign threads
and not any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "benign" and .confidence == "high"
)

Field Validations

Loading…

Comments (0)

Loading comments...