Detection rules › Sublime MQL

Sublime MQL rules: venmo

Rule	Severity
Venmo payment request abuse	`medium`

Venmo payment request abuse

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

A fraudulent payment request found in the body of the message sent by exploiting Venmo's platform. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Callback Phishing, BEC/Fraud
Tactics and techniques	Social engineering, Impersonation: Brand, Evasion

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.current_thread
body.html
sender.email
type

Rule Body

type.inbound
and length(attachments) == 0
and sender.email.domain.root_domain in ("venmo.com")
and strings.ilike(body.html.display_text, "*requests $*")
and (
  (
    // icontains a phone number
    (
      regex.icontains(strings.replace_confusables(body.current_thread.text),
                      '.*\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}.*\n'
      )
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*\+[ilo0-9]{1,3}[ilo0-9]{10}.*\n'
      )
      // +12028001238
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*[ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}.*\n'
      )
      // 202-800-1238
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}.*\n'
      )
      // (202) 800-1238
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*\([ilo0-9]{3}\)[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}.*\n'
      )
      // (202)-800-1238
      or regex.icontains(strings.replace_confusables(body.current_thread.text),
                         '.*\([ilo0-9]{3}\)-[ilo0-9]{3}-[ilo0-9]{4}.*\n'
      )
      or ( // 8123456789
        regex.icontains(strings.replace_confusables(body.current_thread.text),
                        '.*8[ilo0-9]{9}.*\n'
        )
        and regex.icontains(strings.replace_confusables(body.current_thread.text
                            ),
                            '\+[1l]'
        )
      )
    )
    and (
      (
        4 of (
          strings.ilike(body.html.inner_text, '*you did not*'),
          strings.ilike(body.html.inner_text, '*is not for*'),
          strings.ilike(body.html.inner_text, '*done by you*'),
          regex.icontains(body.html.inner_text, "didn\'t ma[kd]e this"),
          strings.ilike(body.html.inner_text, '*Fruad Alert*'),
          strings.ilike(body.html.inner_text, '*Fraud Alert*'),
          strings.ilike(body.html.inner_text, '*fraudulent*'),
          strings.ilike(body.html.inner_text, '*using your PayPal*'),
          strings.ilike(body.html.inner_text, '*subscription*'),
          strings.ilike(body.html.inner_text, '*antivirus*'),
          strings.ilike(body.html.inner_text, '*order*'),
          strings.ilike(body.html.inner_text, '*support*'),
          strings.ilike(body.html.inner_text, '*sincerely apologize*'),
          strings.ilike(body.html.inner_text, '*receipt*'),
          strings.ilike(body.html.inner_text, '*invoice*'),
          strings.ilike(body.html.inner_text, '*Purchase*'),
          strings.ilike(body.html.inner_text, '*transaction*'),
          strings.ilike(body.html.inner_text, '*Market*Value*'),
          strings.ilike(body.html.inner_text, '*BTC*'),
          strings.ilike(body.html.inner_text, '*call*'),
          strings.ilike(body.html.inner_text, '*get in touch with our*'),
          strings.ilike(body.html.inner_text, '*quickly inform*'),
          strings.ilike(body.html.inner_text, '*quickly reach *'),
          strings.ilike(body.html.inner_text, '*detected unusual transactions*'),
          strings.ilike(body.html.inner_text, '*without your authorization*'),
          strings.ilike(body.html.inner_text, '*cancel*'),
          strings.ilike(body.html.inner_text, '*renew*'),
          strings.ilike(body.html.inner_text, '*refund*'),
          strings.ilike(body.html.inner_text, '*+1*'),
          regex.icontains(body.html.inner_text, 'help.{0,3}desk'),
        )
      )
      or regex.icontains(body.current_thread.text,
                         'note from.{0,50}(?:call|reach|contact|paypal)'
      )
      or any(ml.nlu_classifier(body.current_thread.text).intents,
             .name == "callback_scam"
      )
      or (
        // Unicode confusables words obfuscated in note
        regex.icontains(body.html.inner_text,
                        '\+𝟭|𝗽𝗮𝘆𝗺𝗲𝗻𝘁|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸|𝗿𝗲𝗳𝘂𝗻𝗱|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀|𝗰𝗮𝗹𝗹|𝗰𝗮𝗻𝗰𝗲𝗹'
        )
      )
      or strings.ilike(body.html.inner_text, '*kindly*')
    )
  )
)

Detection Logic

Scope: inbound message.

inbound message
length(attachments) == 0
sender.email.domain.root_domain in ('venmo.com')
body.html.display_text matches '*requests $*'
all of:
- any of:
  - regex.icontains(strings.replace_confusables(body.current_thread.text), '.*\+?([ilo0-9]{1}.)?$?[ilo0-9]{3}?$?.[ilo0-9]{3}.?[ilo0-9]{4}.*\n' )
  - regex.icontains(strings.replace_confusables(body.current_thread.text), '.*\+[ilo0-9]{1,3}[ilo0-9]{10}.*\n' )
  - regex.icontains(strings.replace_confusables(body.current_thread.text), '.*[ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}.*\n' )
  - regex.icontains(strings.replace_confusables(body.current_thread.text), '.*[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}.*\n' )
  - regex.icontains(strings.replace_confusables(body.current_thread.text), '.*$[ilo0-9]{3}$[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}.*\n' )
  - regex.icontains(strings.replace_confusables(body.current_thread.text), '.*$[ilo0-9]{3}$-[ilo0-9]{3}-[ilo0-9]{4}.*\n' )
  - all of:
    
    regex.icontains(strings.replace_confusables(body.current_thread.text), '.*8[ilo0-9]{9}.*\n' )
    regex.icontains(strings.replace_confusables(body.current_thread.text ), '\+[1l]' )
- any of:
  - at least 4 of 30: body.html.inner_text matches any of 30 patterns
    
    *you did not*
    *is not for*
    *done by you*
    didn\'t ma[kd]e this
    *Fruad Alert*
    *Fraud Alert*
    *fraudulent*
    *using your PayPal*
    *subscription*
    *antivirus*
    *order*
    *support*
    *sincerely apologize*
    *receipt*
    *invoice*
    *Purchase*
    *transaction*
    *Market*Value*
    *BTC*
    *call*
    *get in touch with our*
    *quickly inform*
    *quickly reach *
    *detected unusual transactions*
    *without your authorization*
    *cancel*
    *renew*
    *refund*
    *+1*
    help.{0,3}desk
  - body.current_thread.text matches 'note from.{0,50}(?:call|reach|contact|paypal)'
  - any(ml.nlu_classifier(body.current_thread.text).intents, .name == "callback_scam" )
  - body.html.inner_text matches '\\+𝟭|𝗽𝗮𝘆𝗺𝗲𝗻𝘁|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸|𝗿𝗲𝗳𝘂𝗻𝗱|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀|𝗰𝗮𝗹𝗹|𝗰𝗮𝗻𝗰𝗲𝗹'
  - body.html.inner_text matches '*kindly*'

Inspects: body.current_thread.text, body.html.display_text, body.html.inner_text, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.ilike, strings.replace_confusables.

Indicators Matched (44)

Field	Match	Value
`sender.email.domain.root_domain`	member	`venmo.com`
`strings.ilike`	substring	`requests $`
`regex.icontains`	regex	`.\+?([ilo0-9]{1}.)?$?[ilo0-9]{3}?$?.[ilo0-9]{3}.?[ilo0-9]{4}.\n`
`regex.icontains`	regex	`.\+[ilo0-9]{1,3}[ilo0-9]{10}.\n`
`regex.icontains`	regex	`.[ilo0-9]{3}\.[ilo0-9]{3}\.[ilo0-9]{4}.\n`
`regex.icontains`	regex	`.[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}.\n`
`regex.icontains`	regex	`.$[ilo0-9]{3}$[\s-]+[ilo0-9]{3}[\s-]+[ilo0-9]{4}.\n`
`regex.icontains`	regex	`.$[ilo0-9]{3}$-[ilo0-9]{3}-[ilo0-9]{4}.\n`
`regex.icontains`	regex	`.8[ilo0-9]{9}.\n`
`regex.icontains`	regex	`\+[1l]`
`strings.ilike`	substring	`you did not`
`strings.ilike`	substring	`is not for`

32 more

`strings.ilike`	substring	`done by you`
`regex.icontains`	regex	`didn\'t ma[kd]e this`
`strings.ilike`	substring	`Fruad Alert`
`strings.ilike`	substring	`Fraud Alert`
`strings.ilike`	substring	`fraudulent`
`strings.ilike`	substring	`using your PayPal`
`strings.ilike`	substring	`subscription`
`strings.ilike`	substring	`antivirus`
`strings.ilike`	substring	`order`
`strings.ilike`	substring	`support`
`strings.ilike`	substring	`sincerely apologize`
`strings.ilike`	substring	`receipt`
`strings.ilike`	substring	`invoice`
`strings.ilike`	substring	`Purchase`
`strings.ilike`	substring	`transaction`
`strings.ilike`	substring	`MarketValue*`
`strings.ilike`	substring	`BTC`
`strings.ilike`	substring	`call`
`strings.ilike`	substring	`get in touch with our`
`strings.ilike`	substring	`quickly inform`
`strings.ilike`	substring	`quickly reach `
`strings.ilike`	substring	`detected unusual transactions`
`strings.ilike`	substring	`without your authorization`
`strings.ilike`	substring	`cancel`
`strings.ilike`	substring	`renew`
`strings.ilike`	substring	`refund`
`strings.ilike`	substring	`+1`
`regex.icontains`	regex	`help.{0,3}desk`
`regex.icontains`	regex	`note from.{0,50}(?:call\|reach\|contact\|paypal)`
`ml.nlu_classifier(body.current_thread.text).intents[].name`	equals	`callback_scam`
`regex.icontains`	regex	`\+𝟭\|𝗽𝗮𝘆𝗺𝗲𝗻𝘁\|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸\|𝗿𝗲𝗳𝘂𝗻𝗱\|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀\|𝗰𝗮𝗹𝗹\|𝗰𝗮𝗻𝗰𝗲𝗹`
`strings.ilike`	substring	`kindly`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    and
      regex.icontains func_call "regex.icontains(strings.replace_confusables(body.current_thread.text),\n                        '.*8[ilo0-9]{9}.*\\n'\n        )"
      regex.icontains func_call "regex.icontains(strings.replace_confusables(body.current_thread.text\n                            ),\n                            '\\+[1l]'\n        )"
    regex.icontains func_call "regex.icontains(strings.replace_confusables(body.current_thread.text),\n                         '.*[ilo0-9]{3}-[ilo0-9]{3}-[ilo0-9]{4}.*\\n'\n      )"
    regex.icontains func_call "regex.icontains(strings.replace_confusables(body.current_thread.text),\n                         '.*[ilo0-9]{3}\\.[ilo0-9]{3}\\.[ilo0-9]{4}.*\\n'\n      )"
    regex.icontains func_call "regex.icontains(strings.replace_confusables(body.current_thread.text),\n                         '.*\\([ilo0-9]{3}\\)-[ilo0-9]{3}-[ilo0-9]{4}.*\\n'\n      )"
    regex.icontains func_call "regex.icontains(strings.replace_confusables(body.current_thread.text),\n                         '.*\\([ilo0-9]{3}\\)[\\s-]+[ilo0-9]{3}[\\s-]+[ilo0-9]{4}.*\\n'\n      )"
    regex.icontains func_call "regex.icontains(strings.replace_confusables(body.current_thread.text),\n                         '.*\\+[ilo0-9]{1,3}[ilo0-9]{10}.*\\n'\n      )"
    regex.icontains func_call "regex.icontains(strings.replace_confusables(body.current_thread.text),\n                      '.*\\+?([ilo0-9]{1}.)?\\(?[ilo0-9]{3}?\\)?.[ilo0-9]{3}.?[ilo0-9]{4}.*\\n'\n      )"
  or
    body.current_thread.text regex_match "note from.{0,50}(?:call|reach|contact|paypal)"
    body.html.inner_text match "kindly"
    body.html.inner_text regex_match "\\+𝟭|𝗽𝗮𝘆𝗺𝗲𝗻𝘁|𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸|𝗿𝗲𝗳𝘂𝗻𝗱|𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀|𝗰𝗮𝗹𝗹|𝗰𝗮𝗻𝗰𝗲𝗹"
     macro "4 of (\n          strings.ilike(body.html.inner_text, '*you did not*'),\n          strings.ilike(body.html.inner_text, '*is not for*'),\n          strings.ilike(body.html.inner_text, '*done by you*'),\n          regex.icontains(body.html.inner_text, \"didn\\'t ma[kd]e this\"),\n          strings.ilike(body.html.inner_text, '*Fruad Alert*'),\n          strings.ilike(body.html.inner_text, '*Fraud Alert*'),\n          strings.ilike(body.html.inner_text, '*fraudulent*'),\n          strings.ilike(body.html.inner_text, '*using your PayPal*'),\n          strings.ilike(body.html.inner_text, '*subscription*'),\n          strings.ilike(body.html.inner_text, '*antivirus*'),\n          strings.ilike(body.html.inner_text, '*order*'),\n          strings.ilike(body.html.inner_text, '*support*'),\n          strings.ilike(body.html.inner_text, '*sincerely apologize*'),\n          strings.ilike(body.html.inner_text, '*receipt*'),\n          strings.ilike(body.html.inner_text, '*invoice*'),\n          strings.ilike(body.html.inner_text, '*Purchase*'),\n          strings.ilike(body.html.inner_text, '*transaction*'),\n          strings.ilike(body.html.inner_text, '*Market*Value*'),\n          strings.ilike(body.html.inner_text, '*BTC*'),\n          strings.ilike(body.html.inner_text, '*call*'),\n          strings.ilike(body.html.inner_text, '*get in touch with our*'),\n          strings.ilike(body.html.inner_text, '*quickly inform*'),\n          strings.ilike(body.html.inner_text, '*quickly reach *'),\n          strings.ilike(body.html.inner_text, '*detected unusual transactions*'),\n          strings.ilike(body.html.inner_text, '*without your authorization*'),\n          strings.ilike(body.html.inner_text, '*cancel*'),\n          strings.ilike(body.html.inner_text, '*renew*'),\n          strings.ilike(body.html.inner_text, '*refund*'),\n          strings.ilike(body.html.inner_text, '*+1*'),\n          regex.icontains(body.html.inner_text, 'help.{0,3}desk'),\n        )"
     macro "any(ml.nlu_classifier(body.current_thread.text).intents,\n             .name == \"callback_scam\"\n      )"
  attachments length_compare "0"
  body.html.display_text match "requests $"
  sender.email.domain.root_domain eq "venmo.com"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	regex_match	`note from.{0,50}(?:call\|reach\|contact\|paypal)` corpus 4 (mql 4)	`field:"body.current_thread.text" kind:regex_match value:"note from.{0,50}(?:call\|reach\|contact\|paypal)"`
`body.html.display_text`	wildcard	`requests $`	`field:"body.html.display_text" kind:wildcard value:"requests $"`
`body.html.inner_text`	regex_match	`+𝟭` `𝗽𝗮𝘆𝗺𝗲𝗻𝘁` `𝗛𝗲𝗹𝗽 𝗗𝗲𝘀𝗸` `𝗿𝗲𝗳𝘂𝗻𝗱` `𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀` `𝗰𝗮𝗹𝗹` `𝗰𝗮𝗻𝗰𝗲𝗹` corpus 5 (mql 5)	`field:"body.html.inner_text" kind:regex_match`
`body.html.inner_text`	wildcard	`kindly` corpus 4 (mql 4)	`field:"body.html.inner_text" kind:wildcard value:"kindly"`
`sender.email.domain.root_domain`	in	`venmo.com`	`field:"sender.email.domain.root_domain" kind:in value:"venmo.com"`
`type.inbound`	eq	`true` transforms: `boolean` corpus 1212 (mql 1212)	`field:"type.inbound" kind:eq value:"true"`

Back to all Sublime MQL rules