Detection rules › Sublime MQL

Sublime MQL rules: stripe

Rule	Severity
Stripe invoice abuse	`medium`

Stripe invoice abuse

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

A fraudulent invoice/receipt found in the body of the message sent by exploiting Stripe's invoicing service. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	BEC/Fraud, Callback Phishing
Tactics and techniques	PDF

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
body
body.current_thread
headers
headers.auth_summary
sender.email
type

Rule body

type.inbound
and sender.email.domain.root_domain == "stripe.com"
and headers.auth_summary.dmarc.pass
and (
  (
    length(attachments) == 2
    and any(attachments,
            .file_extension == "pdf"
            and any(file.explode(.),
                    4 of (
                      strings.ilike(.scan.ocr.raw, "*Btc Purchase*"),
                      strings.ilike(.scan.ocr.raw, "*suspicious activity*"),
                      strings.ilike(.scan.ocr.raw,
                                    "*get in touch with us straight once*"
                      ),
                      strings.ilike(.scan.ocr.raw, "*your phone number*"),
                      strings.ilike(.scan.ocr.raw, "*due deducted*"),
                      strings.ilike(.scan.ocr.raw,
                                    "*merchant security service center*"
                      )
                    )
            )
    )
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence == "high"
    )
    and 2 of (
      strings.icontains(body.current_thread.text, "processing your payment"),
      strings.icontains(body.current_thread.text, "payment has been received"),
      strings.icontains(body.current_thread.text, "order status update"),
      strings.icontains(body.current_thread.text, "ship your items"),
      strings.icontains(body.current_thread.text, "reach out:"),
      strings.icontains(body.current_thread.text, "pay this invoice"),
      strings.icontains(body.current_thread.text, "dear"),
      strings.icontains(body.current_thread.text, "need to cancel"),
      strings.icontains(body.current_thread.text, "Яеոеԝаⅼ"),
      strings.icontains(body.current_thread.text, "order confirmation"),
    )
  )
)

Detection logic

Scope: inbound message.

inbound message
sender.email.domain.root_domain is 'stripe.com'
headers.auth_summary.dmarc.pass
any of:
- all of:
  - length(attachments) is 2
  - any of attachments where all hold:
    
    .file_extension is 'pdf'
    any of file.explode(.) where:
    
    at least 4 of 6: .scan.ocr.raw matches any of 6 patterns
    
    *Btc Purchase*
    *suspicious activity*
    *get in touch with us straight once*
    *your phone number*
    *due deducted*
    *merchant security service center*
- all of:
  - any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    
    .name is 'callback_scam'
    .confidence is 'high'
  - at least 2 of 10: body.current_thread.text contains any of 10 patterns
    
    processing your payment
    payment has been received
    order status update
    ship your items
    reach out:
    pay this invoice
    dear
    need to cancel
    Яеոеԝаⅼ
    order confirmation

Inspects: attachments[].file_extension, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, ml.nlu_classifier, strings.icontains, strings.ilike.

Indicators matched (20)

Field	Match	Value
`sender.email.domain.root_domain`	equals	`stripe.com`
`attachments[].file_extension`	equals	`pdf`
`strings.ilike`	substring	`Btc Purchase`
`strings.ilike`	substring	`suspicious activity`
`strings.ilike`	substring	`get in touch with us straight once`
`strings.ilike`	substring	`your phone number`
`strings.ilike`	substring	`due deducted`
`strings.ilike`	substring	`merchant security service center`
`ml.nlu_classifier(body.current_thread.text).intents[].name`	equals	`callback_scam`
`ml.nlu_classifier(body.current_thread.text).intents[].confidence`	equals	`high`
`strings.icontains`	substring	`processing your payment`
`strings.icontains`	substring	`payment has been received`

8 more

`strings.icontains`	substring	`order status update`
`strings.icontains`	substring	`ship your items`
`strings.icontains`	substring	`reach out:`
`strings.icontains`	substring	`pay this invoice`
`strings.icontains`	substring	`dear`
`strings.icontains`	substring	`need to cancel`
`strings.icontains`	substring	`Яеոеԝаⅼ`
`strings.icontains`	substring	`order confirmation`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    and
      any(attachments)
        and
          any(file.explode(attachments))
            or
              file.explode(attachments[])[].scan.ocr.raw match "Btc Purchase"
              file.explode(attachments[])[].scan.ocr.raw match "due deducted"
              file.explode(attachments[])[].scan.ocr.raw match "get in touch with us straight once"
              file.explode(attachments[])[].scan.ocr.raw match "merchant security service center"
              file.explode(attachments[])[].scan.ocr.raw match "suspicious activity"
              file.explode(attachments[])[].scan.ocr.raw match "your phone number"
          attachments.file_extension eq "pdf"
      attachments length_compare "2"
    and
      any(ml.nlu_classifier(body.current_thread.text).intents)
        and
          ml.nlu_classifier(body.current_thread.text).intents.confidence eq "high"
          ml.nlu_classifier(body.current_thread.text).intents.name eq "callback_scam"
      or
        body.current_thread.text contains "dear"
        body.current_thread.text contains "need to cancel"
        body.current_thread.text contains "order confirmation"
        body.current_thread.text contains "order status update"
        body.current_thread.text contains "pay this invoice"
        body.current_thread.text contains "payment has been received"
        body.current_thread.text contains "processing your payment"
        body.current_thread.text contains "reach out:"
        body.current_thread.text contains "ship your items"
        body.current_thread.text contains "Яеոеԝаⅼ"
  headers.auth_summary.dmarc.pass eq "true"
  sender.email.domain.root_domain eq "stripe.com"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	contains	`dear` `need to cancel` `order confirmation` `order status update` `pay this invoice` `payment has been received` `processing your payment` `reach out:` `ship your items` `Яеոеԝаⅼ`	`field:"body.current_thread.text" kind:contains`
`headers.auth_summary.dmarc.pass`	eq	`true` transforms: `boolean`	`field:"headers.auth_summary.dmarc.pass" kind:eq value:"true"`
`sender.email.domain.root_domain`	eq	`stripe.com`	`field:"sender.email.domain.root_domain" kind:eq value:"stripe.com"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`