detection.wiki

Detection rules › Sublime MQL

Service abuse: Callback phishing via Microsoft Teams invite

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects abuse of legitimate Microsoft Teams invites containing callback scam content, including brand references and financial transaction language with phone numbers.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing
Tactics and techniquesImpersonation: Brand, Out of band pivot, Social engineering

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
sender.email
subject
type

Rule body MQL

type.inbound
and sender.email.domain.domain == "teams.mail.microsoft"
// MS Teams invite indicators
and (
  any(body.links,
      .display_text == "Open Microsoft Teams"
      and (
        .href_url.domain.domain == "login.microsoftonline.com"
        or strings.iends_with(.href_url.query_params,
                              "login.microsoftonline.com"
        )
      )
  )
)
and (
  (
    regex.icontains(strings.replace_confusables(body.current_thread.text),
                    (
                      "mcafee|norton|geek.{0,5}squad|pay.?pal|ebay|symantec|best buy|lifelock|(ms|microsoft|teams).{0,10}premium"
                    )
    )
    or 3 of (
      strings.ilike(body.current_thread.text, '*purchase*'),
      strings.ilike(body.current_thread.text, '*p?ym?nt*'),
      strings.ilike(body.current_thread.text, '*transaction*'),
      strings.ilike(body.current_thread.text, '*subscription*'),
      strings.ilike(body.current_thread.text, '*antivirus*'),
      strings.ilike(body.current_thread.text, '*order*'),
      strings.ilike(body.current_thread.text, '*support*'),
      strings.ilike(body.current_thread.text, '*help line*'),
      strings.ilike(body.current_thread.text, '*receipt*'),
      strings.ilike(body.current_thread.text, '*c?ntact*'),
      strings.ilike(body.current_thread.text, '*cancel*'),
      strings.ilike(body.current_thread.text, '*renew*'),
      strings.ilike(body.current_thread.text, '*refund*'),
      strings.ilike(body.current_thread.text, '*billing*'),
      regex.icontains(body.current_thread.text, '[li]nv.[li]ce')
    )
  )
  // phone number regex
  and any([body.current_thread.text, subject.subject],
          regex.icontains(.,
                          '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}'
          )
  )
)

Detection logic

Scope: inbound message.

Detects abuse of legitimate Microsoft Teams invites containing callback scam content, including brand references and financial transaction language with phone numbers.

  1. inbound message
  2. sender.email.domain.domain is 'teams.mail.microsoft'
  3. any of body.links where all hold:
    • .display_text is 'Open Microsoft Teams'
    • any of:
      • .href_url.domain.domain is 'login.microsoftonline.com'
      • .href_url.query_params ends with 'login.microsoftonline.com'
  4. all of:
    • any of:
      • strings.replace_confusables(body.current_thread.text) matches 'mcafee|norton|geek.{0,5}squad|pay.?pal|ebay|symantec|best buy|lifelock|(ms|microsoft|teams).{0,10}premium'
      • at least 3 of 15: body.current_thread.text matches any of 15 patterns
        • *purchase*
        • *p?ym?nt*
        • *transaction*
        • *subscription*
        • *antivirus*
        • *order*
        • *support*
        • *help line*
        • *receipt*
        • *c?ntact*
        • *cancel*
        • *renew*
        • *refund*
        • *billing*
        • [li]nv.[li]ce
    • any of [body.current_thread.text, subject.subject] where:
      • . matches '\\+?([ilo0-9]{1}.)?\\(?[ilo0-9]{3}?\\)?.[ilo0-9]{3}.?[ilo0-9]{4}'

Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain.domain, body.links[].href_url.query_params, sender.email.domain.domain, subject.subject, type.inbound. Sensors: regex.icontains, strings.iends_with, strings.ilike, strings.replace_confusables.

Indicators matched (21)

FieldMatchValue
sender.email.domain.domainequalsteams.mail.microsoft
body.links[].display_textequalsOpen Microsoft Teams
body.links[].href_url.domain.domainequalslogin.microsoftonline.com
strings.iends_withsuffixlogin.microsoftonline.com
regex.icontainsregexmcafee|norton|geek.{0,5}squad|pay.?pal|ebay|symantec|best buy|lifelock|(ms|microsoft|teams).{0,10}premium
strings.ilikesubstring*purchase*
strings.ilikesubstring*p?ym?nt*
strings.ilikesubstring*transaction*
strings.ilikesubstring*subscription*
strings.ilikesubstring*antivirus*
strings.ilikesubstring*order*
strings.ilikesubstring*support*
9 more
strings.ilikesubstring*help line*
strings.ilikesubstring*receipt*
strings.ilikesubstring*c?ntact*
strings.ilikesubstring*cancel*
strings.ilikesubstring*renew*
strings.ilikesubstring*refund*
strings.ilikesubstring*billing*
regex.icontainsregex[li]nv.[li]ce
regex.icontainsregex\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}