Detection rules › Sublime MQL
Service abuse: Microsoft Power Automate callback scam impersonation
Detects callback scam attempts using the legitimate Microsoft Power Automate service email address with high-confidence callback scam language in the message body.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Out of band pivot, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.email == 'flow-noreply@microsoft.com'
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam" and .confidence != "low"
)
Detection logic
Scope: inbound message.
Detects callback scam attempts using the legitimate Microsoft Power Automate service email address with high-confidence callback scam language in the message body.
- inbound message
- sender.email.email is 'flow-noreply@microsoft.com'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'callback_scam'
- .confidence is not 'low'
Inspects: body.current_thread.text, sender.email.email, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | flow-noreply@microsoft.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | callback_scam |