sublimemediumRule

Callback Scam: Outlook groups

Detects inbound messages sent to Outlook group distribution lists (groups.outlook.com) where the body text is classified with high confidence as callback scam intent by an NLU model, while excluding cases where recipient lists are empty or entirely invalid.

MITRE ATT&CK

T1566.003 T1598 T1566

initial-access

Detection Query

type.inbound
and all(recipients.to, .email.domain.domain == "groups.outlook.com")
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence == "high"
)
and not (
  length(recipients.to) == 0 or all(recipients.to, .email.domain.valid == false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Callback Scam: Outlook groups"
description: "Detects inbound messages sent to Outlook group distribution lists (groups.outlook.com) where the body text is classified with high confidence as callback scam intent by an NLU model, while excluding cases where recipient lists are empty or entirely invalid."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and all(recipients.to, .email.domain.domain == "groups.outlook.com")
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name == "callback_scam" and .confidence == "high"
  )
  and not (
    length(recipients.to) == 0 or all(recipients.to, .email.domain.valid == false)
  )
attack_types:
  - "Callback Phishing"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Natural Language Understanding"
  - "Header analysis"
id: "e8775a29-c10d-5b02-825f-8baa5112e57f"