detection.wiki

Detection rules › Sublime MQL

Callback phishing via Google Meet

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects Google Meet invitations that include callback phishing content in the body, impersonating brands like McAfee, Norton, PayPal, or Best Buy with purchase-related language and phone numbers to solicit victim contact.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing
Tactics and techniquesOut of band pivot

Event coverage

Message attribute
attachments (collection)
body
body.current_thread
body.links (collection)
subject
type

Rule body MQL

type.inbound
and length(attachments) == 2
and all(attachments,
        .content_type == "text/calendar" or .file_extension == "ics"
)
and strings.starts_with(subject.base, "Invitation:")
// Google Meet indicators
and (
  any(body.links,
      .display_text == "Join with Google Meet"
      and .href_url.domain.domain == "meet.google.com"
  )
)
and (
  (
    regex.icontains(body.current_thread.text,
                    (
                      "mcafee|norton|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifelock"
                    )
    )
    and 3 of (
      strings.ilike(body.current_thread.text, '*purchase*'),
      strings.ilike(body.current_thread.text, '*payment*'),
      strings.ilike(body.current_thread.text, '*transaction*'),
      strings.ilike(body.current_thread.text, '*subscription*'),
      strings.ilike(body.current_thread.text, '*antivirus*'),
      strings.ilike(body.current_thread.text, '*order*'),
      strings.ilike(body.current_thread.text, '*support*'),
      strings.ilike(body.current_thread.text, '*help line*'),
      strings.ilike(body.current_thread.text, '*receipt*'),
      strings.ilike(body.current_thread.text, '*invoice*'),
      strings.ilike(body.current_thread.text, '*call*'),
      strings.ilike(body.current_thread.text, '*cancel*'),
      strings.ilike(body.current_thread.text, '*renew*'),
      strings.ilike(body.current_thread.text, '*refund*')
    )
    // toll-free phone number regex
    and any([body.current_thread.text, subject.subject],
            regex.icontains(., '\b\+?(\d{1}.)?\(?8\d{2}?\)?.\d{3}.?\d{4}\b')
    )
  )
)

Detection logic

Scope: inbound message.

Detects Google Meet invitations that include callback phishing content in the body, impersonating brands like McAfee, Norton, PayPal, or Best Buy with purchase-related language and phone numbers to solicit victim contact.

  1. inbound message
  2. length(attachments) is 2
  3. all of attachments where any holds:
    • .content_type is 'text/calendar'
    • .file_extension is 'ics'
  4. subject.base starts with 'Invitation:'
  5. any of body.links where all hold:
    • .display_text is 'Join with Google Meet'
    • .href_url.domain.domain is 'meet.google.com'
  6. all of:
    • body.current_thread.text matches 'mcafee|norton|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifelock'
    • at least 3 of 14: body.current_thread.text matches any of 14 patterns
      • *purchase*
      • *payment*
      • *transaction*
      • *subscription*
      • *antivirus*
      • *order*
      • *support*
      • *help line*
      • *receipt*
      • *invoice*
      • *call*
      • *cancel*
      • *renew*
      • *refund*
    • any of [body.current_thread.text, subject.subject] where:
      • . matches '\\b\\+?(\\d{1}.)?\\(?8\\d{2}?\\)?.\\d{3}.?\\d{4}\\b'

Inspects: attachments[].content_type, attachments[].file_extension, body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain.domain, subject.base, subject.subject, type.inbound. Sensors: regex.icontains, strings.ilike, strings.starts_with.

Indicators matched (21)

FieldMatchValue
attachments[].content_typeequalstext/calendar
attachments[].file_extensionequalsics
strings.starts_withprefixInvitation:
body.links[].display_textequalsJoin with Google Meet
body.links[].href_url.domain.domainequalsmeet.google.com
regex.icontainsregexmcafee|norton|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifelock
strings.ilikesubstring*purchase*
strings.ilikesubstring*payment*
strings.ilikesubstring*transaction*
strings.ilikesubstring*subscription*
strings.ilikesubstring*antivirus*
strings.ilikesubstring*order*
9 more
strings.ilikesubstring*support*
strings.ilikesubstring*help line*
strings.ilikesubstring*receipt*
strings.ilikesubstring*invoice*
strings.ilikesubstring*call*
strings.ilikesubstring*cancel*
strings.ilikesubstring*renew*
strings.ilikesubstring*refund*
regex.icontainsregex\b\+?(\d{1}.)?\(?8\d{2}?\)?.\d{3}.?\d{4}\b