detection.wiki

Detection rules › Sublime MQL

BEC/Fraud: Student loan callback phishing

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule detects phishing emails that attempt to engage the recipient by soliciting a callback under the guise of student loan forgiveness or assistance. The messages often come from free email providers, lack a proper HTML structure, and include suspicious indicators such as phone numbers embedded in the text. These emails typically contain language urging the recipient to respond or take immediate action, leveraging urgency around student loan repayment to entice engagement.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesFree email provider, Out of band pivot, Social engineering

Event coverage

Message attribute
body.current_thread
body.html
sender.email
type

Rule body MQL

type.inbound
// there is no HTML body
and body.html.raw is null

// but the current thread contains what's most likely an html tag
// (eg. <>'s' followed by a closing </> )
and regex.contains(body.current_thread.text, '<[^>]+>.*?</[^>]+>')

// and the body mentions student loans
and strings.icontains(body.current_thread.text, "Student Loan")

// sourced from a free mail provider
and sender.email.domain.root_domain in $free_email_providers

// contains a phone number
and (
  regex.contains(strings.replace_confusables(body.current_thread.text),
                 '\+?(\d{1}.)?\(?\d{3}?\)?.\d{3}.?\d{4}'
  )
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '\+\d{1,3}[ilo0-9]{10}'
  )
  // +12028001238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '[ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}'
  )
  // 202.800.1238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}'
  )
  // 202-800-1238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '\([ilo0-9]{3}\)\s[ilo0-9]{3}-[ilo0-9]{4}'
  )
  // (202) 800-1238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '\([ilo0-9]{3}\)[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}'
  )
  // (202)-800-1238
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '1 [ilo0-9]{3} [ilo0-9]{3} [ilo0-9]{4}'
  ) // 8123456789
  or regex.contains(strings.replace_confusables(body.current_thread.text),
                    '8\d{9}'
  )
)

// contains a request
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "request"
)

Detection logic

Scope: inbound message.

This rule detects phishing emails that attempt to engage the recipient by soliciting a callback under the guise of student loan forgiveness or assistance. The messages often come from free email providers, lack a proper HTML structure, and include suspicious indicators such as phone numbers embedded in the text. These emails typically contain language urging the recipient to respond or take immediate action, leveraging urgency around student loan repayment to entice engagement.

  1. inbound message
  2. body.html.raw is missing
  3. body.current_thread.text matches '<[^>]+>.*?</[^>]+>'
  4. body.current_thread.text contains 'Student Loan'
  5. sender.email.domain.root_domain in $free_email_providers
  6. strings.replace_confusables(body.current_thread.text) matches any of 8 patterns
    • \+?(\d{1}.)?\(?\d{3}?\)?.\d{3}.?\d{4}
    • \+\d{1,3}[ilo0-9]{10}
    • [ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}
    • [ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}
    • \([ilo0-9]{3}\)\s[ilo0-9]{3}-[ilo0-9]{4}
    • \([ilo0-9]{3}\)[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}
    • 1 [ilo0-9]{3} [ilo0-9]{3} [ilo0-9]{4}
    • 8\d{9}
  7. any of ml.nlu_classifier(body.current_thread.text).entities where:
    • .name is 'request'

Inspects: body.current_thread.text, body.html.raw, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, regex.contains, strings.icontains, strings.replace_confusables. Reference lists: $free_email_providers.

Indicators matched (11)

FieldMatchValue
regex.containsregex<[^>]+>.*?</[^>]+>
strings.icontainssubstringStudent Loan
regex.containsregex\+?(\d{1}.)?\(?\d{3}?\)?.\d{3}.?\d{4}
regex.containsregex\+\d{1,3}[ilo0-9]{10}
regex.containsregex[ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}
regex.containsregex[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}
regex.containsregex\([ilo0-9]{3}\)\s[ilo0-9]{3}-[ilo0-9]{4}
regex.containsregex\([ilo0-9]{3}\)[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}
regex.containsregex1 [ilo0-9]{3} [ilo0-9]{3} [ilo0-9]{4}
regex.containsregex8\d{9}
ml.nlu_classifier(body.current_thread.text).entities[].nameequalsrequest