Detection rules › Sublime MQL

Attachment: Credit card application with WhatsApp contact

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing promotional credit card offers with attached forms requesting extensive personal information (PII) and directing victims to contact via WhatsApp, indicating potential fraud.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesSocial engineering, Out of band pivot

Event coverage

Rule body MQL

type.inbound
// promotional/advertising content targeting financial services
and (
  (
    regex.icontains(body.current_thread.text,
                    "credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free|special offer"
    )
    or regex.icontains(subject.subject,
                       "credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free"
    )
  )
  and any(ml.nlu_classifier(body.current_thread.text).topics,
          .name in ("Advertising and Promotions")
  )
)
// PII harvesting template in attachments (3+ of these patterns)
and any(attachments,
        any(file.explode(.),
            3 of (
              regex.icontains(.scan.strings.raw, "Credit Card Application"),
              regex.icontains(.scan.strings.raw, "Date of Birth"),
              regex.icontains(.scan.strings.raw, "[eE]mail"),
              regex.icontains(.scan.strings.raw, "[aA]ddress"),
              regex.icontains(.scan.strings.raw, "Contact No"),
              regex.icontains(.scan.strings.raw, "Pan No"),
              regex.icontains(.scan.strings.raw, "ADHAAR"),
              regex.icontains(.scan.strings.raw, "Annual.*salary"),
              regex.icontains(.scan.strings.raw, "Mother Name"),
              regex.icontains(.scan.strings.raw, "Father Name"),
              regex.icontains(.scan.strings.raw, "SINGLE.*MARRIED")
            )
        )
)
// WhatsApp contact method (suspicious for legitimate financial institutions)
and (
  regex.icontains(body.current_thread.text, "whatsapp")
  or any(attachments,
         any(file.explode(.), regex.icontains(.scan.qr.url.url, "wa\\.me"))
  )
  or any(file.explode(file.message_screenshot()),
         regex.icontains(.scan.qr.url.url, "wa\\.me")
  )
)

Detection logic

Scope: inbound message.

Detects messages containing promotional credit card offers with attached forms requesting extensive personal information (PII) and directing victims to contact via WhatsApp, indicating potential fraud.

  1. inbound message
  2. all of:
    • any of:
      • body.current_thread.text matches 'credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free|special offer'
      • subject.subject matches 'credit card.*offer|promotional.*credit|free.*credit card|lifetime.*free'
    • any of ml.nlu_classifier(body.current_thread.text).topics where:
      • .name in ('Advertising and Promotions')
  3. any of attachments where:
    • any of file.explode(.) where:
      • at least 3 of 11: .scan.strings.raw matches any of 11 patterns
        • Credit Card Application
        • Date of Birth
        • [eE]mail
        • [aA]ddress
        • Contact No
        • Pan No
        • ADHAAR
        • Annual.*salary
        • Mother Name
        • Father Name
        • SINGLE.*MARRIED
  4. any of:
    • body.current_thread.text matches 'whatsapp'
    • any of attachments where:
      • any of file.explode(.) where:
        • .scan.qr.url.url matches 'wa\\\\.me'
    • any of file.explode(...) where:
      • .scan.qr.url.url matches 'wa\\\\.me'

Inspects: body.current_thread.text, subject.subject, type.inbound. Sensors: file.explode, file.message_screenshot, ml.nlu_classifier, regex.icontains.

Indicators matched (16)

FieldMatchValue
regex.icontainsregexcredit card.*offer|promotional.*credit|free.*credit card|lifetime.*free|special offer
regex.icontainsregexcredit card.*offer|promotional.*credit|free.*credit card|lifetime.*free
ml.nlu_classifier(body.current_thread.text).topics[].namememberAdvertising and Promotions
regex.icontainsregexCredit Card Application
regex.icontainsregexDate of Birth
regex.icontainsregex[eE]mail
regex.icontainsregex[aA]ddress
regex.icontainsregexContact No
regex.icontainsregexPan No
regex.icontainsregexADHAAR
regex.icontainsregexAnnual.*salary
regex.icontainsregexMother Name
4 more
regex.icontainsregexFather Name
regex.icontainsregexSINGLE.*MARRIED
regex.icontainsregexwhatsapp
regex.icontainsregexwa\\.me