sublimehighRule

Callback phishing via Google Group abuse

A fraudulent invoice/receipt found in the body of the message, delivered via a Google Group mailing list.

MITRE ATT&CK

T1566.003 T1598 T1566.002 T1598.003 T1566

initial-access

Detection Query

type.inbound
and length(attachments) < 5
and sender.email.domain.domain == "googlegroups.com"
and (
  any(attachments,
      (.file_type in $file_types_images or .file_type == "pdf")
      and (
        any(file.explode(.),
            // exclude images taken with mobile cameras and screenshots from android
            not any(.scan.exiftool.fields,
                    (
                      .key == "Model"
                      or (
                        .key == "Software"
                        and strings.starts_with(.value, "Android")
                      )
                    )
                    // exclude images taken with mobile cameras and screenshots from Apple
                    and (
                      .key == "DeviceManufacturer"
                      and .value == "Apple Computer Inc."
                    )
            )
            and any(ml.nlu_classifier(.scan.ocr.raw).intents,
                    .name == "callback_scam" and .confidence == "high"
            )
        )
      )
  )
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name in ("callback_scam") and .confidence == "high"
  )
)
and (
  not profile.by_sender().solicited
  and not profile.by_sender().any_messages_benign
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Callback phishing via Google Group abuse"
description: "A fraudulent invoice/receipt found in the body of the message, delivered via a Google Group mailing list."
type: "rule"
severity: "high"
source: |
  type.inbound
  and length(attachments) < 5
  and sender.email.domain.domain == "googlegroups.com"
  and (
    any(attachments,
        (.file_type in $file_types_images or .file_type == "pdf")
        and (
          any(file.explode(.),
              // exclude images taken with mobile cameras and screenshots from android
              not any(.scan.exiftool.fields,
                      (
                        .key == "Model"
                        or (
                          .key == "Software"
                          and strings.starts_with(.value, "Android")
                        )
                      )
                      // exclude images taken with mobile cameras and screenshots from Apple
                      and (
                        .key == "DeviceManufacturer"
                        and .value == "Apple Computer Inc."
                      )
              )
              and any(ml.nlu_classifier(.scan.ocr.raw).intents,
                      .name == "callback_scam" and .confidence == "high"
              )
          )
        )
    )
    or any(ml.nlu_classifier(body.current_thread.text).intents,
           .name in ("callback_scam") and .confidence == "high"
    )
  )
  and (
    not profile.by_sender().solicited
    and not profile.by_sender().any_messages_benign
  )
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not headers.auth_summary.dmarc.pass
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )

attack_types:
  - "Callback Phishing"
tactics_and_techniques:
  - "Free email provider"
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "File analysis"
  - "Natural Language Understanding"
  - "Optical Character Recognition"
  - "Sender analysis"
id: "199d873b-9703-50df-a8d5-f4dc4322222b"