Service abuse: Facebook mail notification callback scam

name: "Service abuse: Facebook mail notification callback scam"
description: "Detects inbound messages spoofing Facebook's official notification address that contain callback scam intent identified with medium or high confidence. Attackers leverage the trusted Facebook sender identity to deceive recipients into calling a fraudulent phone number."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and sender.email.email == "notification@facebookmail.com"
  // legitimate messages from this address use Facebook as the display name
  and sender.display_name != "Facebook"
  and (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence != "low"
    )
    or (
      regex.icontains(body.current_thread.text,
                      (
                        "mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck"
                      )
      )
      and (
        3 of (
          strings.ilike(body.current_thread.text, '*purchase*'),
          strings.ilike(body.current_thread.text, '*payment*'),
          strings.ilike(body.current_thread.text, '*transaction*'),
          strings.ilike(body.current_thread.text, '*subscription*'),
          strings.ilike(body.current_thread.text, '*antivirus*'),
          strings.ilike(body.current_thread.text, '*order*'),
          strings.ilike(body.current_thread.text, '*support*'),
          strings.ilike(body.current_thread.text, '*receipt*'),
          strings.ilike(body.current_thread.text, '*invoice*'),
          strings.ilike(body.current_thread.text, '*call*'),
          strings.ilike(body.current_thread.text, '*cancel*'),
          strings.ilike(body.current_thread.text, '*renew*'),
          strings.ilike(body.current_thread.text, '*refund*'),
          strings.ilike(body.current_thread.text, '*host key*')
        )
      )
      // phone number regex
      and any([body.current_thread.text, subject.subject],
              regex.icontains(strings.replace_confusables(.),
                              '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                              '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}',
                              '[\+\x{FF0B}]?(?:\p{N}[^\p{N}]{0,3}){10,11}',
                              '[\+\x{FF0B}][\s\(\)]*(?:[\p{L}\p{N}\p{No}\p{So}][\s\(\)\-⋅.\x{2298}]{0,3}){9,12}'
              )
      )
    )
  )
attack_types:
  - "Callback Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "Sender analysis"
  - "Natural Language Understanding"
id: "5037b74e-d0ba-5a4e-a754-ae90f3ecc87d"