detection.wiki

Detection rules › Sublime MQL

Service abuse: AWS SNS callback scam impersonation

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects callback scam messages sent through Amazon Web Services Simple Notification Service (SNS) that impersonate well-known brands like McAfee, Norton, PayPal, and others. The rule identifies fraudulent purchase receipts or service notifications containing phone numbers to solicit victim callbacks, potentially leading to financial theft or malware installation.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing
Tactics and techniquesImpersonation: Brand, Out of band pivot, Social engineering

Event coverage

Message attribute
body.current_thread
headers.return_path
sender.email
subject
type

Rule body MQL

type.inbound
and sender.email.email == "no-reply@sns.amazonaws.com"
and not coalesce(strings.icontains(headers.return_path.local_part,
                                   'aws-ses-bounces'
                 ),
                 false
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "callback_scam" and .confidence != "low"
  )
  or (
    regex.icontains(body.current_thread.text,
                    (
                      "mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck"
                    )
    )
    and (
      3 of (
        strings.ilike(body.current_thread.text, '*purchase*'),
        strings.ilike(body.current_thread.text, '*payment*'),
        strings.ilike(body.current_thread.text, '*transaction*'),
        strings.ilike(body.current_thread.text, '*subscription*'),
        strings.ilike(body.current_thread.text, '*antivirus*'),
        strings.ilike(body.current_thread.text, '*order*'),
        strings.ilike(body.current_thread.text, '*support*'),
        strings.ilike(body.current_thread.text, '*receipt*'),
        strings.ilike(body.current_thread.text, '*invoice*'),
        strings.ilike(body.current_thread.text, '*call*'),
        strings.ilike(body.current_thread.text, '*cancel*'),
        strings.ilike(body.current_thread.text, '*renew*'),
        strings.ilike(body.current_thread.text, '*refund*'),
        strings.ilike(body.current_thread.text, '*host key*')
      )
    )
    // phone number regex
    and any([body.current_thread.text, subject.subject],
            regex.icontains(.,
                            '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                            '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
            )
    )
  )
)

Detection logic

Scope: inbound message.

Detects callback scam messages sent through Amazon Web Services Simple Notification Service (SNS) that impersonate well-known brands like McAfee, Norton, PayPal, and others. The rule identifies fraudulent purchase receipts or service notifications containing phone numbers to solicit victim callbacks, potentially leading to financial theft or malware installation.

  1. inbound message
  2. sender.email.email is 'no-reply@sns.amazonaws.com'
  3. not:
    • coalesce(strings.icontains(headers.return_path.local_part, 'aws-ses-bounces'))
  4. any of:
    • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
      • .name is 'callback_scam'
      • .confidence is not 'low'
    • all of:
      • body.current_thread.text matches 'mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck'
      • at least 3 of 14: body.current_thread.text matches any of 14 patterns
        • *purchase*
        • *payment*
        • *transaction*
        • *subscription*
        • *antivirus*
        • *order*
        • *support*
        • *receipt*
        • *invoice*
        • *call*
        • *cancel*
        • *renew*
        • *refund*
        • *host key*
      • any of [body.current_thread.text, subject.subject] where:
        • . matches any of 2 patterns
          • \+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}
          • \+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}

Inspects: body.current_thread.text, headers.return_path.local_part, sender.email.email, subject.subject, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.icontains, strings.ilike.

Indicators matched (20)

FieldMatchValue
sender.email.emailequalsno-reply@sns.amazonaws.com
strings.icontainssubstringaws-ses-bounces
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscallback_scam
regex.icontainsregexmcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck
strings.ilikesubstring*purchase*
strings.ilikesubstring*payment*
strings.ilikesubstring*transaction*
strings.ilikesubstring*subscription*
strings.ilikesubstring*antivirus*
strings.ilikesubstring*order*
strings.ilikesubstring*support*
strings.ilikesubstring*receipt*
8 more
strings.ilikesubstring*invoice*
strings.ilikesubstring*call*
strings.ilikesubstring*cancel*
strings.ilikesubstring*renew*
strings.ilikesubstring*refund*
strings.ilikesubstring*host key*
regex.icontainsregex\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}
regex.icontainsregex\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}