sublimehighRule

Service abuse: Coursera callback scam

Detects inbound messages spoofing Coursera transactional notifications - such as email confirmation requests or account change alerts - sent from Coursera's legitimate sending infrastructure, but targeting recipients on newly registered domains or containing mailto links pointing to newly registered non-Coursera domains. The combination of authentic-looking Coursera branding with anomalous recipient or embedded contact domains suggests account takeover or credential harvesting activity targeting Coursera users.

MITRE ATT&CK

T1566.003 T1598 T1566.002 T1598.003 T1583.001 T1566

initial-access

Detection Query

type.inbound
// message is sent from coursera (auth doesn't really matter here)
and sender.email.domain.root_domain == "coursera.org"
and (
  // the email being changed appears in the body as a link
  any(body.links,
      .href_url.scheme == "mailto"
      and .href_url.domain.root_domain != "coursera.org"
      // the domain is newly registered
      and network.whois(.href_url.domain).days_old < 365
  )
  // in other cases the email address isn't in the email body and it's only as a rcpt
  or network.whois(recipients.to[0].email.domain).days_old < 365
  // extract the first line and do NLU on it
  or any(ml.nlu_classifier(regex.extract(body.current_thread.text,
                                         '^(?P<first_line>[^\n]+)\n'
                           )[0].named_groups["first_line"]
         ).intents,
         .name == "callback_scam" and .confidence == "high"
  )
)
// not in org_domains
and all(recipients.to, .email.domain.domain not in $org_domains)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Service abuse: Coursera callback scam"
description: "Detects inbound messages spoofing Coursera transactional notifications - such as email confirmation requests or account change alerts - sent from Coursera's legitimate sending infrastructure, but targeting recipients on newly registered domains or containing mailto links pointing to newly registered non-Coursera domains. The combination of authentic-looking Coursera branding with anomalous recipient or embedded contact domains suggests account takeover or credential harvesting activity targeting Coursera users."
type: "rule"
severity: "high"
source: |
  type.inbound
  // message is sent from coursera (auth doesn't really matter here)
  and sender.email.domain.root_domain == "coursera.org"
  and (
    // the email being changed appears in the body as a link
    any(body.links,
        .href_url.scheme == "mailto"
        and .href_url.domain.root_domain != "coursera.org"
        // the domain is newly registered
        and network.whois(.href_url.domain).days_old < 365
    )
    // in other cases the email address isn't in the email body and it's only as a rcpt
    or network.whois(recipients.to[0].email.domain).days_old < 365
    // extract the first line and do NLU on it
    or any(ml.nlu_classifier(regex.extract(body.current_thread.text,
                                           '^(?P<first_line>[^\n]+)\n'
                             )[0].named_groups["first_line"]
           ).intents,
           .name == "callback_scam" and .confidence == "high"
    )
  )
  // not in org_domains
  and all(recipients.to, .email.domain.domain not in $org_domains)
attack_types:
  - "Callback Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Lookalike domain"
  - "Social engineering"
detection_methods:
  - "Sender analysis"
  - "URL analysis"
  - "Whois"
id: "ea4293c3-8b11-58ba-85f0-0a03af2b21ed"