detection.wiki

Detection rules › Sublime MQL

Attachment: Callback phishing solicitation via image file

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

A fraudulent invoice/receipt found in an image attachment. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing
Tactics and techniquesEvasion, Free email provider, Out of band pivot, Social engineering, Image as content

Event coverage

Message attribute
attachments (collection)
headers (collection)
recipients
recipients.to (collection)
sender.email
subject
type

Rule body MQL

type.inbound
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not (subject.is_reply and headers.in_reply_to is not null)
and not profile.by_sender_email().prevalence == "common"
and (
  sender.email.domain.root_domain in $free_email_providers
  or sender.email.domain.root_domain in ("onmicrosoft.com")
  or (
    (
      length(recipients.to) == 0
      or all(recipients.to, .display_name == "Undisclosed recipients")
    )
    and length(recipients.cc) == 0
    and length(recipients.bcc) == 0
  )
)
and any(attachments,
        // exclude images taken with mobile cameras and screenshots from android
        .file_type in $file_types_images
        and (
          any(file.explode(.),
              not any(.scan.exiftool.fields,
                      .key == "Model"
                      or (
                        .key == "Software"
                        and strings.starts_with(.value, "Android")
                      )
              )
              // exclude images taken with mobile cameras and screenshots from Apple
              and not any(.scan.exiftool.fields,
                          .key == "DeviceManufacturer"
                          and .value == "Apple Computer Inc."
              )
              and not any(.scan.exiftool.fields,
                          .key == "UserComment" and .value == "Screenshot"
              )
              // 4 of the following strings are found        
              and 4 of (
                // this section is synced with attachment_callback_phish_with_pdf.yml and body_callback_phishing_no_attachment.yml
                strings.icontains(.scan.ocr.raw, "purchase"),
                strings.icontains(.scan.ocr.raw, "payment"),
                strings.icontains(.scan.ocr.raw, "transaction"),
                strings.icontains(.scan.ocr.raw, "subscription"),
                strings.icontains(.scan.ocr.raw, "antivirus"),
                strings.icontains(.scan.ocr.raw, "order"),
                strings.icontains(.scan.ocr.raw, "support"),
                strings.icontains(.scan.ocr.raw, "help line"),
                strings.icontains(.scan.ocr.raw, "receipt"),
                strings.icontains(.scan.ocr.raw, "invoice"),
                strings.icontains(.scan.ocr.raw, "call"),
                strings.icontains(.scan.ocr.raw, "helpdesk"),
                strings.icontains(.scan.ocr.raw, "cancel"),
                strings.icontains(.scan.ocr.raw, "renew"),
                strings.icontains(.scan.ocr.raw, "refund"),
                regex.icontains(.scan.ocr.raw, "(?:reach|contact) us at"),
                strings.icontains(.scan.ocr.raw, "+1"),
                strings.icontains(.scan.ocr.raw, "amount"),
                strings.icontains(.scan.ocr.raw, "charged"),
                strings.icontains(.scan.ocr.raw, "crypto"),
                strings.icontains(.scan.ocr.raw, "wallet address"),
                regex.icontains(.scan.ocr.raw, '\$\d{3}\.\d{2}\b'),
                regex.icontains(.scan.ocr.raw,
                                '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                                '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
                ),
              )
              // this section is synced with attachment_callback_phish_with_pdf.yml and body_callback_phishing_no_attachment.yml
              and regex.icontains(.scan.ocr.raw,
                                  '(p.{0,3}a.{0,3}y.{0,3}p.{0,3}a.{0,3}l|ma?c.?fee|n[o0]rt[o0]n|geek.{0,5}squad|ebay|symantec|best buy|lifel[o0]c|secure anywhere|starz|utilities premium|pc security|at&t)'
              )
          )
          // this section is synced with attachment_callback_phish_with_pdf.yml and body_callback_phishing_no_attachment.yml
          or any(ml.logo_detect(.).brands,
                 .name in (
                   "PayPal",
                   "Norton",
                   "GeekSquad",
                   "Ebay",
                   "McAfee",
                   "AT&T"
                 )
          )
        )
)

Detection logic

Scope: inbound message.

A fraudulent invoice/receipt found in an image attachment. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.

  1. inbound message
  2. any of:
    • not:
      • profile.by_sender().solicited
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign
  3. not:
    • all of:
      • subject.is_reply
      • headers.in_reply_to is set
  4. not:
    • profile.by_sender_email().prevalence is 'common'
  5. any of:
    • sender.email.domain.root_domain in $free_email_providers
    • sender.email.domain.root_domain in ('onmicrosoft.com')
    • all of:
      • any of:
        • length(recipients.to) is 0
        • all of recipients.to where:
          • .display_name is 'Undisclosed recipients'
      • length(recipients.cc) is 0
      • length(recipients.bcc) is 0
  6. any of attachments where all hold:
    • .file_type in $file_types_images
    • any of:
      • any of file.explode(.) where all hold:
        • not:
          • any of .scan.exiftool.fields where any holds:
            • .key is 'Model'
            • all of:
              • .key is 'Software'
              • .value starts with 'Android'
        • not:
          • any of .scan.exiftool.fields where all hold:
            • .key is 'DeviceManufacturer'
            • .value is 'Apple Computer Inc.'
        • not:
          • any of .scan.exiftool.fields where all hold:
            • .key is 'UserComment'
            • .value is 'Screenshot'
        • at least 4 of:
          • .scan.ocr.raw contains 'purchase'
          • .scan.ocr.raw contains 'payment'
          • .scan.ocr.raw contains 'transaction'
          • .scan.ocr.raw contains 'subscription'
          • .scan.ocr.raw contains 'antivirus'
          • .scan.ocr.raw contains 'order'
          • .scan.ocr.raw contains 'support'
          • .scan.ocr.raw contains 'help line'
          • .scan.ocr.raw contains 'receipt'
          • .scan.ocr.raw contains 'invoice'
          • .scan.ocr.raw contains 'call'
          • .scan.ocr.raw contains 'helpdesk'
          • .scan.ocr.raw contains 'cancel'
          • .scan.ocr.raw contains 'renew'
          • .scan.ocr.raw contains 'refund'
          • .scan.ocr.raw matches '(?:reach|contact) us at'
          • .scan.ocr.raw contains '+1'
          • .scan.ocr.raw contains 'amount'
          • .scan.ocr.raw contains 'charged'
          • .scan.ocr.raw contains 'crypto'
          • .scan.ocr.raw contains 'wallet address'
          • .scan.ocr.raw matches '\\$\\d{3}\\.\\d{2}\\b'
          • .scan.ocr.raw matches any of 2 patterns
            • \+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}
            • \+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}
        • .scan.ocr.raw matches '(p.{0,3}a.{0,3}y.{0,3}p.{0,3}a.{0,3}l|ma?c.?fee|n[o0]rt[o0]n|geek.{0,5}squad|ebay|symantec|best buy|lifel[o0]c|secure anywhere|starz|utilities premium|pc security|at&t)'
      • any of ml.logo_detect(.).brands where:
        • .name in ('PayPal', 'Norton', 'GeekSquad', 'Ebay', 'McAfee', 'AT&T')

Inspects: attachments[].file_type, headers.in_reply_to, recipients.bcc, recipients.cc, recipients.to, recipients.to[].display_name, sender.email.domain.root_domain, subject.is_reply, type.inbound. Sensors: file.explode, ml.logo_detect, profile.by_sender, profile.by_sender_email, regex.icontains, strings.icontains, strings.starts_with. Reference lists: $file_types_images, $free_email_providers.

Indicators matched (40)

FieldMatchValue
sender.email.domain.root_domainmemberonmicrosoft.com
recipients.to[].display_nameequalsUndisclosed recipients
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsModel
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsSoftware
strings.starts_withprefixAndroid
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsDeviceManufacturer
file.explode(attachments[])[].scan.exiftool.fields[].valueequalsApple Computer Inc.
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsUserComment
file.explode(attachments[])[].scan.exiftool.fields[].valueequalsScreenshot
strings.icontainssubstringpurchase
strings.icontainssubstringpayment
strings.icontainssubstringtransaction
28 more
strings.icontainssubstringsubscription
strings.icontainssubstringantivirus
strings.icontainssubstringorder
strings.icontainssubstringsupport
strings.icontainssubstringhelp line
strings.icontainssubstringreceipt
strings.icontainssubstringinvoice
strings.icontainssubstringcall
strings.icontainssubstringhelpdesk
strings.icontainssubstringcancel
strings.icontainssubstringrenew
strings.icontainssubstringrefund
regex.icontainsregex(?:reach|contact) us at
strings.icontainssubstring+1
strings.icontainssubstringamount
strings.icontainssubstringcharged
strings.icontainssubstringcrypto
strings.icontainssubstringwallet address
regex.icontainsregex\$\d{3}\.\d{2}\b
regex.icontainsregex\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}
regex.icontainsregex\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}
regex.icontainsregex(p.{0,3}a.{0,3}y.{0,3}p.{0,3}a.{0,3}l|ma?c.?fee|n[o0]rt[o0]n|geek.{0,5}squad|ebay|symantec|best buy|lifel[o0]c|secure anywhere|starz|utilities premium|pc security|at&t)
ml.logo_detect(attachments[]).brands[].namememberPayPal
ml.logo_detect(attachments[]).brands[].namememberNorton
ml.logo_detect(attachments[]).brands[].namememberGeekSquad
ml.logo_detect(attachments[]).brands[].namememberEbay
ml.logo_detect(attachments[]).brands[].namememberMcAfee
ml.logo_detect(attachments[]).brands[].namememberAT&T