Detection rules › Sublime MQL
Service abuse: WeTransfer callback scam
Detects callback scams originating from legitimate WeTransfer noreply address using natural language processing to identify high-confidence callback scam intent in the message body.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Social engineering, Out of band pivot |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.email == 'noreply@wetransfer.com'
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "callback_scam"
)
Detection logic
Scope: inbound message.
Detects callback scams originating from legitimate WeTransfer noreply address using natural language processing to identify high-confidence callback scam intent in the message body.
- inbound message
- sender.email.email is 'noreply@wetransfer.com'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere:- .name is 'callback_scam'
Inspects: body.current_thread.text, sender.email.email, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | noreply@wetransfer.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | callback_scam |