detection.wiki

Detection rules › Sublime MQL

Callback phishing: Social Security Administration fraud

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects phishing attempts that impersonate the Social Security Administration, using a single PDF attachment containing specific fraud-related language and a callback number.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing
Tactics and techniquesEvasion, Free email provider, Out of band pivot, PDF, Social engineering

Event coverage

Message attribute
attachments (collection)
sender.email
type

Rule body MQL

type.inbound
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

// single attachment
and length(attachments) == 1

// sender is freemail
and sender.email.domain.root_domain in $free_email_providers

// the attachment is a pdf with 1 page, and at least 60 ocr chars
and any(attachments,
        .file_extension == "pdf"
        and any(file.explode(.), .scan.exiftool.page_count == 1)
        and any(file.explode(.), length(.scan.ocr.raw) > 60)

        // 4 of the following strings are found        
        and (
          any(file.explode(.),
              4 of (
                strings.icontains(.scan.ocr.raw, "fraudulent activity"),
                strings.icontains(.scan.ocr.raw, "Social Security Number"),
                strings.icontains(.scan.ocr.raw, "SSN"),
                strings.icontains(.scan.ocr.raw, "stolen"),
                strings.icontains(.scan.ocr.raw, "illicit activities"),
                strings.icontains(.scan.ocr.raw,
                                  "Social Security Administration"
                ),
                strings.icontains(.scan.ocr.raw, "if you are innocent"),
                strings.icontains(.scan.ocr.raw, "help line"),
                strings.icontains(.scan.ocr.raw, "Department of Justice"),
                strings.icontains(.scan.ocr.raw, "innocent"),
                regex.icontains(.scan.ocr.raw, '\$\d{3}\.\d{2}\b')
                and (
                  regex.contains(.scan.ocr.raw,
                                 '(\+\d|1.(\()?\d{3}(\))?\D\d{3}\D\d{4})'
                  )
                  or regex.contains(.scan.ocr.raw,
                                    '\+?(\d{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}\d{3}[\s\.\-⋅]{0,5}\d{4}'
                  )
                )
              )
          )
        )
)

Detection logic

Scope: inbound message.

Detects phishing attempts that impersonate the Social Security Administration, using a single PDF attachment containing specific fraud-related language and a callback number.

  1. inbound message
  2. any of:
    • not:
      • profile.by_sender().solicited
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign
  3. length(attachments) is 1
  4. sender.email.domain.root_domain in $free_email_providers
  5. any of attachments where all hold:
    • .file_extension is 'pdf'
    • any of file.explode(.) where:
      • .scan.exiftool.page_count is 1
    • any of file.explode(.) where:
      • length(.scan.ocr.raw) > 60
    • any of file.explode(.) where:
      • at least 4 of:
        • .scan.ocr.raw contains 'fraudulent activity'
        • .scan.ocr.raw contains 'Social Security Number'
        • .scan.ocr.raw contains 'SSN'
        • .scan.ocr.raw contains 'stolen'
        • .scan.ocr.raw contains 'illicit activities'
        • .scan.ocr.raw contains 'Social Security Administration'
        • .scan.ocr.raw contains 'if you are innocent'
        • .scan.ocr.raw contains 'help line'
        • .scan.ocr.raw contains 'Department of Justice'
        • .scan.ocr.raw contains 'innocent'
        • all of:
          • .scan.ocr.raw matches '\\$\\d{3}\\.\\d{2}\\b'
          • any of:
            • .scan.ocr.raw matches '(\\+\\d|1.(\\()?\\d{3}(\\))?\\D\\d{3}\\D\\d{4})'
            • .scan.ocr.raw matches '\\+?(\\d{1,2})?\\s?\\(?\\d{3}\\)?[\\s\\.\\-⋅]{0,5}\\d{3}[\\s\\.\\-⋅]{0,5}\\d{4}'

Inspects: attachments[].file_extension, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, profile.by_sender, regex.contains, regex.icontains, strings.icontains. Reference lists: $free_email_providers.

Indicators matched (14)

FieldMatchValue
attachments[].file_extensionequalspdf
strings.icontainssubstringfraudulent activity
strings.icontainssubstringSocial Security Number
strings.icontainssubstringSSN
strings.icontainssubstringstolen
strings.icontainssubstringillicit activities
strings.icontainssubstringSocial Security Administration
strings.icontainssubstringif you are innocent
strings.icontainssubstringhelp line
strings.icontainssubstringDepartment of Justice
strings.icontainssubstringinnocent
regex.icontainsregex\$\d{3}\.\d{2}\b
2 more
regex.containsregex(\+\d|1.(\()?\d{3}(\))?\D\d{3}\D\d{4})
regex.containsregex\+?(\d{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}\d{3}[\s\.\-⋅]{0,5}\d{4}