detection.wiki

Detection rules › Sublime MQL

Callback Phishing via Zoom comment

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects callback scams sent through legitimate Zoom infrastructure that impersonate well-known brands like McAfee, Norton, or PayPal. These messages contain purchase or support-related language along with phone numbers, attempting to trick recipients into calling fraudulent support lines.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing
Tactics and techniquesOut of band pivot, Social engineering, Impersonation: Brand

Event coverage

Message attribute
body.current_thread
headers.auth_summary
sender
sender.email
subject
type

Rule body MQL

type.inbound
and length(attachments) == 0

// Legitimate Zoom sending infratructure
and sender.email.domain.root_domain == 'zoom.us'
and (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)

// Zoom Logo
and any(ml.logo_detect(file.message_screenshot()).brands, .name == "Zoom")

// Callback Phishing
and regex.icontains(body.current_thread.text,
                    (
                      "mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck"
                    )
)
and (
  3 of (
    strings.ilike(body.current_thread.text, '*purchase*'),
    strings.ilike(body.current_thread.text, '*payment*'),
    strings.ilike(body.current_thread.text, '*transaction*'),
    strings.ilike(body.current_thread.text, '*subscription*'),
    strings.ilike(body.current_thread.text, '*antivirus*'),
    strings.ilike(body.current_thread.text, '*order*'),
    strings.ilike(body.current_thread.text, '*support*'),
    strings.ilike(body.current_thread.text, '*help line*'),
    strings.ilike(body.current_thread.text, '*receipt*'),
    strings.ilike(body.current_thread.text, '*invoice*'),
    strings.ilike(body.current_thread.text, '*call*'),
    strings.ilike(body.current_thread.text, '*cancel*'),
    strings.ilike(body.current_thread.text, '*renew*'),
    strings.ilike(body.current_thread.text, '*refund*'),
    strings.ilike(body.current_thread.text, '*host key*')
  )
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name == "callback_scam" and .confidence != "low"
  )
)
// phone number regex
and any([body.current_thread.text, subject.subject],
        regex.icontains(.,
                        '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                        '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
        )
)
// negation for legitimate AI generated meeting summaries from Zoom
and not (
  (
    sender.display_name == "Meeting Summary with AI Companion"
    and sender.email.email == "no-reply@zoom.us"
    and headers.auth_summary.dmarc.pass
  )
  or (
    strings.icontains(subject.subject, "Meeting assets")
    and strings.icontains(body.current_thread.text, "Meeting summary")
    and sender.email.email == "no-reply@zoom.us"
    and headers.auth_summary.dmarc.pass
  )
)

Detection logic

Scope: inbound message.

Detects callback scams sent through legitimate Zoom infrastructure that impersonate well-known brands like McAfee, Norton, or PayPal. These messages contain purchase or support-related language along with phone numbers, attempting to trick recipients into calling fraudulent support lines.

  1. inbound message
  2. length(attachments) is 0
  3. sender.email.domain.root_domain is 'zoom.us'
  4. any of:
    • headers.auth_summary.spf.pass
    • headers.auth_summary.dmarc.pass
  5. any of ml.logo_detect(file.message_screenshot()).brands where:
    • .name is 'Zoom'
  6. body.current_thread.text matches 'mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck'
  7. any of:
    • at least 3 of 15: body.current_thread.text matches any of 15 patterns
      • *purchase*
      • *payment*
      • *transaction*
      • *subscription*
      • *antivirus*
      • *order*
      • *support*
      • *help line*
      • *receipt*
      • *invoice*
      • *call*
      • *cancel*
      • *renew*
      • *refund*
      • *host key*
    • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
      • .name is 'callback_scam'
      • .confidence is not 'low'
  8. any of [body.current_thread.text, subject.subject] where:
    • . matches any of 2 patterns
      • \+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}
      • \+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}
  9. none of:
    • all of:
      • sender.display_name is 'Meeting Summary with AI Companion'
      • sender.email.email is 'no-reply@zoom.us'
      • headers.auth_summary.dmarc.pass
    • all of:
      • subject.subject contains 'Meeting assets'
      • body.current_thread.text contains 'Meeting summary'
      • sender.email.email is 'no-reply@zoom.us'
      • headers.auth_summary.dmarc.pass

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, sender.display_name, sender.email.domain.root_domain, sender.email.email, subject.subject, type.inbound. Sensors: file.message_screenshot, ml.logo_detect, ml.nlu_classifier, regex.icontains, strings.icontains, strings.ilike.

Indicators matched (25)

FieldMatchValue
sender.email.domain.root_domainequalszoom.us
ml.logo_detect(file.message_screenshot()).brands[].nameequalsZoom
regex.icontainsregexmcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck
strings.ilikesubstring*purchase*
strings.ilikesubstring*payment*
strings.ilikesubstring*transaction*
strings.ilikesubstring*subscription*
strings.ilikesubstring*antivirus*
strings.ilikesubstring*order*
strings.ilikesubstring*support*
strings.ilikesubstring*help line*
strings.ilikesubstring*receipt*
13 more
strings.ilikesubstring*invoice*
strings.ilikesubstring*call*
strings.ilikesubstring*cancel*
strings.ilikesubstring*renew*
strings.ilikesubstring*refund*
strings.ilikesubstring*host key*
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscallback_scam
regex.icontainsregex\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}
regex.icontainsregex\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}
sender.display_nameequalsMeeting Summary with AI Companion
sender.email.emailequalsno-reply@zoom.us
strings.icontainssubstringMeeting assets
strings.icontainssubstringMeeting summary