Detection rules › Sublime MQL
Stripe invoice abuse
A fraudulent invoice/receipt found in the body of the message sent by exploiting Stripe's invoicing service. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Callback Phishing |
| Tactics and techniques |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(attachments) == 2
and sender.email.domain.root_domain == "stripe.com"
and headers.auth_summary.dmarc.pass
and any(attachments,
.file_extension == "pdf"
and any(file.explode(.),
4 of (
strings.ilike(.scan.ocr.raw, "*Btc Purchase*"),
strings.ilike(.scan.ocr.raw, "*suspicious activity*"),
strings.ilike(.scan.ocr.raw,
"*get in touch with us straight once*"
),
strings.ilike(.scan.ocr.raw, "*your phone number*"),
strings.ilike(.scan.ocr.raw, "*due deducted*"),
strings.ilike(.scan.ocr.raw,
"*merchant security service center*"
),
)
)
)
Detection logic
Scope: inbound message.
A fraudulent invoice/receipt found in the body of the message sent by exploiting Stripe's invoicing service. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.
- inbound message
- length(attachments) is 2
- sender.email.domain.root_domain is 'stripe.com'
- headers.auth_summary.dmarc.pass
any of
attachmentswhere all hold:- .file_extension is 'pdf'
any of
file.explode(.)where:at least 4 of 6: .scan.ocr.raw matches any of 6 patterns
*Btc Purchase**suspicious activity**get in touch with us straight once**your phone number**due deducted**merchant security service center*
Inspects: attachments[].file_extension, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, strings.ilike.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | stripe.com |
attachments[].file_extension | equals | pdf |
strings.ilike | substring | *Btc Purchase* |
strings.ilike | substring | *suspicious activity* |
strings.ilike | substring | *get in touch with us straight once* |
strings.ilike | substring | *your phone number* |
strings.ilike | substring | *due deducted* |
strings.ilike | substring | *merchant security service center* |