Detection rules › Sublime MQL
Service abuse: Google Groups callback scam
Detects inbound messages originating from Google Groups that contain high-confidence callback scam content, identifying abuse of the legitimate service to distribute fraudulent callback requests.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Free email provider, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.domain == "groups.google.com"
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam" and .confidence == "high"
)
Detection logic
Scope: inbound message.
Detects inbound messages originating from Google Groups that contain high-confidence callback scam content, identifying abuse of the legitimate service to distribute fraudulent callback requests.
- inbound message
- sender.email.domain.domain is 'groups.google.com'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'callback_scam'
- .confidence is 'high'
Inspects: body.current_thread.text, sender.email.domain.domain, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
sender.email.domain.domain | equals | groups.google.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | callback_scam |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |