sublimemediumRule

Service abuse: Calendly callback scam detection

Detects inbound messages from Calendly's notification system that contain callback scam content, as identified through natural language processing with medium or high confidence levels.

MITRE ATT&CK

T1566.003 T1598 T1566 T1566.002 T1598.003

initial-access

Detection Query

type.inbound
and sender.email.email in (
  "no-reply@calendly.com",
  "notifications@calendly.com"
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence != "low"
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Service abuse: Calendly callback scam detection"
description: "Detects inbound messages from Calendly's notification system that contain callback scam content, as identified through natural language processing with medium or high confidence levels."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and sender.email.email in (
    "no-reply@calendly.com",
    "notifications@calendly.com"
  )
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name == "callback_scam" and .confidence != "low"
  )
attack_types:
  - "Callback Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Impersonation: Brand"
detection_methods:
  - "Natural Language Understanding"
  - "Sender analysis"
id: "646f5d81-c830-5122-9b73-283cc918373c"