Callback phishing via Google Meet

name: "Callback phishing via Google Meet"
description: "Detects Google Meet invitations that include callback phishing content in the body, impersonating brands like McAfee, Norton, PayPal, or Best Buy with purchase-related language and phone numbers to solicit victim contact."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and length(attachments) == 2
  and all(attachments,
          .content_type == "text/calendar" or .file_extension == "ics"
  )
  and strings.starts_with(subject.base, "Invitation:")
  // Google Meet indicators
  and (
    any(body.links,
        .display_text == "Join with Google Meet"
        and .href_url.domain.domain == "meet.google.com"
    )
  )
  and (
    (
      regex.icontains(body.current_thread.text,
                      (
                        "mcafee|norton|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifelock"
                      )
      )
      and 3 of (
        strings.ilike(body.current_thread.text, '*purchase*'),
        strings.ilike(body.current_thread.text, '*payment*'),
        strings.ilike(body.current_thread.text, '*transaction*'),
        strings.ilike(body.current_thread.text, '*subscription*'),
        strings.ilike(body.current_thread.text, '*antivirus*'),
        strings.ilike(body.current_thread.text, '*order*'),
        strings.ilike(body.current_thread.text, '*support*'),
        strings.ilike(body.current_thread.text, '*help line*'),
        strings.ilike(body.current_thread.text, '*receipt*'),
        strings.ilike(body.current_thread.text, '*invoice*'),
        strings.ilike(body.current_thread.text, '*call*'),
        strings.ilike(body.current_thread.text, '*cancel*'),
        strings.ilike(body.current_thread.text, '*renew*'),
        strings.ilike(body.current_thread.text, '*refund*')
      )
      // toll-free phone number regex
      and any([body.current_thread.text, subject.subject],
              regex.icontains(., '\b\+?(\d{1}.)?\(?8\d{2}?\)?.\d{3}.?\d{4}\b')
      )
    )
  )
attack_types:
  - "Callback Phishing"
tactics_and_techniques:
  - "Out of band pivot"
detection_methods:
  - "Content analysis"
id: "70e01845-b815-5be5-87ac-11ae7477367e"