Detection rules › Sublime MQL
Service abuse: PayPal manager account creation with callback scam indicators
Detects inbound messages abusing PayPal's noreply address with subjects about PayPal Manager user account creation that contain callback scam intent patterns identified through natural language analysis.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing, Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering, Spoofing |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and sender.email.email == "noreply@paypal.com"
and strings.icontains(subject.base,
"Creation of your PayPal Manager user account"
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("callback_scam", "cred_theft") and .confidence != "low"
)
Detection logic
Scope: inbound message.
Detects inbound messages abusing PayPal's noreply address with subjects about PayPal Manager user account creation that contain callback scam intent patterns identified through natural language analysis.
- inbound message
- sender.email.email is 'noreply@paypal.com'
- subject.base contains 'Creation of your PayPal Manager user account'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name in ('callback_scam', 'cred_theft')
- .confidence is not 'low'
Inspects: body.current_thread.text, sender.email.email, subject.base, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | noreply@paypal.com |
strings.icontains | substring | Creation of your PayPal Manager user account |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | callback_scam |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | cred_theft |