Detection rules › Sublime MQL
Service abuse: IBM IAM account notification with callback scam indicators
Detects inbound messages abusing IBM's IAM account notification address that contain callback scam intent patterns identified through natural language analysis.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering, Out of band pivot |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.email == "ibmacct@iam.ibm.com"
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam" and .confidence != "low"
)
Detection logic
Scope: inbound message.
Detects inbound messages abusing IBM's IAM account notification address that contain callback scam intent patterns identified through natural language analysis.
- inbound message
- sender.email.email is 'ibmacct@iam.ibm.com'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'callback_scam'
- .confidence is not 'low'
Inspects: body.current_thread.text, sender.email.email, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | ibmacct@iam.ibm.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | callback_scam |