detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: stripe

RuleSeverity
Stripe invoice abusemedium

Stripe invoice abuse

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

A fraudulent invoice/receipt found in the body of the message sent by exploiting Stripe's invoicing service. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Callback Phishing
Tactics and techniquesPDF

Telemetry Coverage

PlatformRecord / event type
SublimeInbound email message

Message Attributes

  • attachments
  • body
  • body.current_thread
  • headers
  • headers.auth_summary
  • sender.email
  • type

Rule Body

type.inbound
and sender.email.domain.root_domain == "stripe.com"
and headers.auth_summary.dmarc.pass
and (
  (
    length(attachments) == 2
    and any(attachments,
            .file_extension == "pdf"
            and any(file.explode(.),
                    4 of (
                      strings.ilike(.scan.ocr.raw, "*Btc Purchase*"),
                      strings.ilike(.scan.ocr.raw, "*suspicious activity*"),
                      strings.ilike(.scan.ocr.raw,
                                    "*get in touch with us straight once*"
                      ),
                      strings.ilike(.scan.ocr.raw, "*your phone number*"),
                      strings.ilike(.scan.ocr.raw, "*due deducted*"),
                      strings.ilike(.scan.ocr.raw,
                                    "*merchant security service center*"
                      )
                    )
            )
    )
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence == "high"
    )
    and 2 of (
      strings.icontains(body.current_thread.text, "processing your payment"),
      strings.icontains(body.current_thread.text, "payment has been received"),
      strings.icontains(body.current_thread.text, "order status update"),
      strings.icontains(body.current_thread.text, "ship your items"),
      strings.icontains(body.current_thread.text, "reach out:"),
      strings.icontains(body.current_thread.text, "pay this invoice"),
      strings.icontains(body.current_thread.text, "dear"),
      strings.icontains(body.current_thread.text, "need to cancel"),
      strings.icontains(body.current_thread.text, "Яеոеԝаⅼ"),
      strings.icontains(body.current_thread.text, "order confirmation"),
    )
  )
)

Detection Logic

Scope: inbound message.

A fraudulent invoice/receipt found in the body of the message sent by exploiting Stripe's invoicing service. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.

  1. inbound message
  2. sender.email.domain.root_domain is 'stripe.com'
  3. headers.auth_summary.dmarc.pass
  4. any of:
    • all of:
      • length(attachments) == 2
      • any of attachments where all hold:
        • .file_extension is 'pdf'
        • any(file.explode(.), 4 of ( strings.ilike(.scan.ocr.raw, "*Btc Purchase*"), strings.ilike(.scan.ocr.raw, "*suspicious activity*"), strings.ilike(.scan.ocr.raw, "*get in touch with us straight once*" ), strings.ilike(.scan.ocr.raw, "*your phone number*"), strings.ilike(.scan.ocr.raw, "*due deducted*"), strings.ilike(.scan.ocr.raw, "*merchant security service center*" ) ) )
    • all of:
      • any(ml.nlu_classifier(body.current_thread.text).intents, .name == "callback_scam" and .confidence == "high" )
      • at least 2 of 10: body.current_thread.text contains any of 10 patterns
        • processing your payment
        • payment has been received
        • order status update
        • ship your items
        • reach out:
        • pay this invoice
        • dear
        • need to cancel
        • Яеոеԝаⅼ
        • order confirmation

Inspects: attachments[].file_extension, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, ml.nlu_classifier, strings.icontains, strings.ilike.

Indicators Matched (20)

FieldMatchValue
sender.email.domain.root_domainequalsstripe.com
attachments[].file_extensionequalspdf
strings.ilikesubstring*Btc Purchase*
strings.ilikesubstring*suspicious activity*
strings.ilikesubstring*get in touch with us straight once*
strings.ilikesubstring*your phone number*
strings.ilikesubstring*due deducted*
strings.ilikesubstring*merchant security service center*
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscallback_scam
ml.nlu_classifier(body.current_thread.text).intents[].confidenceequalshigh
strings.icontainssubstringprocessing your payment
strings.icontainssubstringpayment has been received
8 more
strings.icontainssubstringorder status update
strings.icontainssubstringship your items
strings.icontainssubstringreach out:
strings.icontainssubstringpay this invoice
strings.icontainssubstringdear
strings.icontainssubstringneed to cancel
strings.icontainssubstringЯеոеԝаⅼ
strings.icontainssubstringorder confirmation

Stages and Predicates

Stage 1: mql_rule

and
  or
    and
      any(attachments)
        and
          attachments.file_extension eq "pdf"
           macro "any(file.explode(.),\n                    4 of (\n                      strings.ilike(.scan.ocr.raw, \"*Btc Purchase*\"),\n                      strings.ilike(.scan.ocr.raw, \"*suspicious activity*\"),\n                      strings.ilike(.scan.ocr.raw,\n                                    \"*get in touch with us straight once*\"\n                      ),\n                      strings.ilike(.scan.ocr.raw, \"*your phone number*\"),\n                      strings.ilike(.scan.ocr.raw, \"*due deducted*\"),\n                      strings.ilike(.scan.ocr.raw,\n                                    \"*merchant security service center*\"\n                      )\n                    )\n            )"
      attachments length_compare "2"
    and
      or
        and
          body.current_thread.text contains "dear"
          body.current_thread.text contains "need to cancel"
        and
          body.current_thread.text contains "dear"
          body.current_thread.text contains "order confirmation"
        and
          body.current_thread.text contains "dear"
          body.current_thread.text contains "order status update"
        and
          body.current_thread.text contains "dear"
          body.current_thread.text contains "pay this invoice"
        and
          body.current_thread.text contains "dear"
          body.current_thread.text contains "payment has been received"
        and
          body.current_thread.text contains "dear"
          body.current_thread.text contains "processing your payment"
        and
          body.current_thread.text contains "dear"
          body.current_thread.text contains "reach out:"
        and
          body.current_thread.text contains "dear"
          body.current_thread.text contains "ship your items"
        and
          body.current_thread.text contains "dear"
          body.current_thread.text contains "Яеոеԝаⅼ"
        and
          body.current_thread.text contains "need to cancel"
          body.current_thread.text contains "order confirmation"
        and
          body.current_thread.text contains "need to cancel"
          body.current_thread.text contains "order status update"
        and
          body.current_thread.text contains "need to cancel"
          body.current_thread.text contains "pay this invoice"
        and
          body.current_thread.text contains "need to cancel"
          body.current_thread.text contains "payment has been received"
        and
          body.current_thread.text contains "need to cancel"
          body.current_thread.text contains "processing your payment"
        and
          body.current_thread.text contains "need to cancel"
          body.current_thread.text contains "reach out:"
        and
          body.current_thread.text contains "need to cancel"
          body.current_thread.text contains "ship your items"
        and
          body.current_thread.text contains "need to cancel"
          body.current_thread.text contains "Яеոеԝаⅼ"
        and
          body.current_thread.text contains "order confirmation"
          body.current_thread.text contains "order status update"
        and
          body.current_thread.text contains "order confirmation"
          body.current_thread.text contains "pay this invoice"
        and
          body.current_thread.text contains "order confirmation"
          body.current_thread.text contains "payment has been received"
        and
          body.current_thread.text contains "order confirmation"
          body.current_thread.text contains "processing your payment"
        and
          body.current_thread.text contains "order confirmation"
          body.current_thread.text contains "reach out:"
        and
          body.current_thread.text contains "order confirmation"
          body.current_thread.text contains "ship your items"
        and
          body.current_thread.text contains "order confirmation"
          body.current_thread.text contains "Яеոеԝаⅼ"
        and
          body.current_thread.text contains "order status update"
          body.current_thread.text contains "pay this invoice"
        and
          body.current_thread.text contains "order status update"
          body.current_thread.text contains "payment has been received"
        and
          body.current_thread.text contains "order status update"
          body.current_thread.text contains "processing your payment"
        and
          body.current_thread.text contains "order status update"
          body.current_thread.text contains "reach out:"
        and
          body.current_thread.text contains "order status update"
          body.current_thread.text contains "ship your items"
        and
          body.current_thread.text contains "order status update"
          body.current_thread.text contains "Яеոеԝаⅼ"
        and
          body.current_thread.text contains "pay this invoice"
          body.current_thread.text contains "payment has been received"
        and
          body.current_thread.text contains "pay this invoice"
          body.current_thread.text contains "processing your payment"
        and
          body.current_thread.text contains "pay this invoice"
          body.current_thread.text contains "reach out:"
        and
          body.current_thread.text contains "pay this invoice"
          body.current_thread.text contains "ship your items"
        and
          body.current_thread.text contains "pay this invoice"
          body.current_thread.text contains "Яеոеԝаⅼ"
        and
          body.current_thread.text contains "payment has been received"
          body.current_thread.text contains "processing your payment"
        and
          body.current_thread.text contains "payment has been received"
          body.current_thread.text contains "reach out:"
        and
          body.current_thread.text contains "payment has been received"
          body.current_thread.text contains "ship your items"
        and
          body.current_thread.text contains "payment has been received"
          body.current_thread.text contains "Яеոеԝаⅼ"
        and
          body.current_thread.text contains "processing your payment"
          body.current_thread.text contains "reach out:"
        and
          body.current_thread.text contains "processing your payment"
          body.current_thread.text contains "ship your items"
        and
          body.current_thread.text contains "processing your payment"
          body.current_thread.text contains "Яеոеԝаⅼ"
        and
          body.current_thread.text contains "reach out:"
          body.current_thread.text contains "ship your items"
        and
          body.current_thread.text contains "reach out:"
          body.current_thread.text contains "Яеոеԝаⅼ"
        and
          body.current_thread.text contains "ship your items"
          body.current_thread.text contains "Яеոеԝаⅼ"
       macro "any(ml.nlu_classifier(body.current_thread.text).intents,\n        .name == \"callback_scam\" and .confidence == \"high\"\n    )"
  headers.auth_summary.dmarc.pass eq "true"
  sender.email.domain.root_domain eq "stripe.com"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
body.current_thread.textcontains
  • dear
  • need to cancel
  • order confirmation
  • order status update
  • pay this invoice
  • payment has been received
  • processing your payment
  • reach out:
  • ship your items
  • Яеոеԝаⅼ
field:"body.current_thread.text" kind:contains
headers.auth_summary.dmarc.passeq
  • true transforms: boolean corpus 39 (mql 39)
field:"headers.auth_summary.dmarc.pass" kind:eq value:"true"
sender.email.domain.root_domaineq
  • stripe.com
field:"sender.email.domain.root_domain" kind:eq value:"stripe.com"
type.inboundeq
  • true transforms: boolean corpus 1212 (mql 1212)
field:"type.inbound" kind:eq value:"true"

Back to all Sublime MQL rules