Detection rules › Sublime MQL
Service abuse: GetAccept callback scam content
Detects callback scam language in messages sent through legitimate GetAccept infrastructure, indicating potential abuse of the service for fraudulent solicitation.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Out of band pivot, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
// Legitimate GetAccept sending infrastructure
and sender.email.domain.root_domain == 'getaccept.com'
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam"
)
Detection logic
Scope: inbound message.
Detects callback scam language in messages sent through legitimate GetAccept infrastructure, indicating potential abuse of the service for fraudulent solicitation.
- inbound message
- sender.email.domain.root_domain is 'getaccept.com'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere:- .name is 'callback_scam'
Inspects: body.current_thread.text, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | getaccept.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | callback_scam |