Detection rules › Sublime MQL
Service abuse: Calendly callback scam detection
Detects inbound messages from Calendly's notification system that contain callback scam content, as identified through natural language processing with medium or high confidence levels.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Social engineering, Impersonation: Brand |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.email == "no-reply@calendly.com"
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam" and .confidence != "low"
)
Detection logic
Scope: inbound message.
Detects inbound messages from Calendly's notification system that contain callback scam content, as identified through natural language processing with medium or high confidence levels.
- inbound message
- sender.email.email is 'no-reply@calendly.com'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'callback_scam'
- .confidence is not 'low'
Inspects: body.current_thread.text, sender.email.email, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | no-reply@calendly.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | callback_scam |