detection.wiki

Detection rules › Sublime MQL

Service abuse: Google classroom solicitation

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages spoofing Google Classroom notifications that contain WhatsApp contact information, phone numbers, or sexually explicit content. The rule identifies emails from no-reply@classroom.google.com that include WhatsApp invitations, emojis in the subject line, or explicit sexual language, as well as phone numbers and WhatsApp references in message screenshots from first-time senders.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing, BEC/Fraud
Tactics and techniquesImpersonation: Brand, Out of band pivot, Social engineering

Event coverage

Message attribute
body.current_thread
body.html
sender.email
subject
type

Rule body MQL

type.inbound
// 
//  Warning: This rule contains sexually explicit keywords
// 
and sender.email.email == "no-reply@classroom.google.com"
and any(regex.iextract(body.html.display_text,
                       '(?P<sender_email>(?P<sender_name>[a-zA-Z0-9._%+-]+)@(?P<sender_domain>[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}))'
        ),
        .named_groups["sender_email"] not in $sender_emails
        and .named_groups["sender_email"] not in $recipient_emails
)
and (
  // check for a WhatsApp invitation in the currend_thread
  (
    regex.icontains(body.current_thread.text, '\bWhatsapp:?.[:0-9+ ]{7,20}\b')
    or (
      strings.icontains(body.current_thread.text, "WhatsApp")
      and strings.icontains(body.current_thread.text, "invited")
    )
    // look for an emoji in the subject
    or (
      regex.icontains(subject.subject,
                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
      )
    )
    // look for sexually explicit subject titles
    or regex.icontains(subject.subject,
                       '(?:give me|your satisfaction|sex|horny|cock|fuck|\bass\b|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes?|sexting|cheating|affair|erotic|\blust\b|desire|intimate|explicit|fetish|kinky|seduce|adult community|cam shows|local (?:girls?|women|single)|hook.?up|bed partner)'
    )
  )
  // check for WhatsApp invitation within the OCR of an attachment. 
  or (
    //
    // This rule makes use of a beta feature and is subject to change without notice
    // using the beta feature in custom rules is not suggested until it has been formally released
    //
    regex.icontains(beta.ocr(file.message_screenshot()).text,
                    // International format with OCR-friendly character classes
                    '\+?[ilo0-9]{1,3}[\s\.\-⋅]?\(?[ilo0-9]{3}\)?[\s\.\-⋅]{0,3}[ilo0-9]{3}[\s\.\-⋅]{0,3}[ilo0-9]{3,4}',
                    // US format
                    '\(?[ilo0-9]{3}\)?[\s\.\-⋅]{0,3}[ilo0-9]{3}[\s\.\-⋅]{0,3}[ilo0-9]{4}',
    )
    // and mentions of WhatsApp in the screenshot
    and (
      regex.icontains(beta.ocr(file.message_screenshot()).text,
                      '[Ww]hats[Aa]pp|[Ww]hatsapp'
      )
      or regex.icontains(beta.ocr(file.message_screenshot()).text, // WhatsApp-specific format
                         '[Ww]hats[Aa]pp:?[\s]*[+]?[ilo0-9\s\.\-⋅\(\)]{10,18}'
      )
    )
  )
)

Detection logic

Scope: inbound message.

Detects messages spoofing Google Classroom notifications that contain WhatsApp contact information, phone numbers, or sexually explicit content. The rule identifies emails from no-reply@classroom.google.com that include WhatsApp invitations, emojis in the subject line, or explicit sexual language, as well as phone numbers and WhatsApp references in message screenshots from first-time senders.

  1. inbound message
  2. sender.email.email is 'no-reply@classroom.google.com'
  3. any of regex.iextract(body.html.display_text) where all hold:
    • .named_groups['sender_email'] not in $sender_emails
    • .named_groups['sender_email'] not in $recipient_emails
  4. any of:
    • any of:
      • body.current_thread.text matches '\\bWhatsapp:?.[:0-9+ ]{7,20}\\b'
      • all of:
        • body.current_thread.text contains 'WhatsApp'
        • body.current_thread.text contains 'invited'
      • subject.subject matches '[\\x{1F300}-\\x{1F5FF}\\x{1F600}-\\x{1F64F}\\x{1F680}-\\x{1F6FF}\\x{1F700}-\\x{1F77F}\\x{1F780}-\\x{1F7FF}\\x{1F900}-\\x{1F9FF}\\x{2600}-\\x{26FF}\\x{2700}-\\x{27BF}\\x{2300}-\\x{23FF}]'
      • subject.subject matches '(?:give me|your satisfaction|sex|horny|cock|fuck|\\bass\\b|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes?|sexting|cheating|affair|erotic|\\blust\\b|desire|intimate|explicit|fetish|kinky|seduce|adult community|cam shows|local (?:girls?|women|single)|hook.?up|bed partner)'
    • all of:
      • beta.ocr(file.message_screenshot()).text matches any of 2 patterns
        • \+?[ilo0-9]{1,3}[\s\.\-⋅]?\(?[ilo0-9]{3}\)?[\s\.\-⋅]{0,3}[ilo0-9]{3}[\s\.\-⋅]{0,3}[ilo0-9]{3,4}
        • \(?[ilo0-9]{3}\)?[\s\.\-⋅]{0,3}[ilo0-9]{3}[\s\.\-⋅]{0,3}[ilo0-9]{4}
      • any of:
        • beta.ocr(file.message_screenshot()).text matches '[Ww]hats[Aa]pp|[Ww]hatsapp'
        • beta.ocr(file.message_screenshot()).text matches '[Ww]hats[Aa]pp:?[\\s]*[+]?[ilo0-9\\s\\.\\-⋅\\(\\)]{10,18}'

Inspects: body.current_thread.text, body.html.display_text, sender.email.email, subject.subject, type.inbound. Sensors: beta.ocr, file.message_screenshot, regex.icontains, regex.iextract, strings.icontains. Reference lists: $recipient_emails, $sender_emails.

Indicators matched (11)

FieldMatchValue
sender.email.emailequalsno-reply@classroom.google.com
regex.iextractregex(?P<sender_email>(?P<sender_name>[a-zA-Z0-9._%+-]+)@(?P<sender_domain>[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}))
regex.icontainsregex\bWhatsapp:?.[:0-9+ ]{7,20}\b
strings.icontainssubstringWhatsApp
strings.icontainssubstringinvited
regex.icontainsregex[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]
regex.icontainsregex(?:give me|your satisfaction|sex|horny|cock|fuck|\bass\b|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes?|sexting|cheating|affair|erotic|\blust\b|desire|intimate|explicit|fetish|kinky|seduce|adult community|cam shows|local (?:girls?|women|single)|hook.?up|bed partner)
regex.icontainsregex\+?[ilo0-9]{1,3}[\s\.\-⋅]?\(?[ilo0-9]{3}\)?[\s\.\-⋅]{0,3}[ilo0-9]{3}[\s\.\-⋅]{0,3}[ilo0-9]{3,4}
regex.icontainsregex\(?[ilo0-9]{3}\)?[\s\.\-⋅]{0,3}[ilo0-9]{3}[\s\.\-⋅]{0,3}[ilo0-9]{4}
regex.icontainsregex[Ww]hats[Aa]pp|[Ww]hatsapp
regex.icontainsregex[Ww]hats[Aa]pp:?[\s]*[+]?[ilo0-9\s\.\-⋅\(\)]{10,18}