Brand impersonation: GitHub with callback scam indicators

name: "Brand impersonation: GitHub with callback scam indicators"
description: "Detects messages using GitHub's noreply address that contain callback scam language, brand impersonation tactics, or fraudulent purchase/payment content with phone numbers for victim contact."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and sender.email.email == 'noreply@github.com'
  and length(attachments) == 0
  and (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "callback_scam" and .confidence != "low"
    )
    or (
      regex.icontains(body.current_thread.text,
                      (
                        "mcafee|n[o0]rt[o0]n|geek.{0,5}squad|paypal|ebay|symantec|best buy|lifel[o0]ck"
                      )
      )
      and (
        3 of (
          strings.ilike(body.current_thread.text, '*purchase*'),
          strings.ilike(body.current_thread.text, '*payment*'),
          strings.ilike(body.current_thread.text, '*transaction*'),
          strings.ilike(body.current_thread.text, '*subscription*'),
          strings.ilike(body.current_thread.text, '*antivirus*'),
          strings.ilike(body.current_thread.text, '*order*'),
          strings.ilike(body.current_thread.text, '*support*'),
          strings.ilike(body.current_thread.text, '*receipt*'),
          strings.ilike(body.current_thread.text, '*invoice*'),
          strings.ilike(body.current_thread.text, '*call*'),
          strings.ilike(body.current_thread.text, '*cancel*'),
          strings.ilike(body.current_thread.text, '*renew*'),
          strings.ilike(body.current_thread.text, '*refund*'),
          strings.ilike(body.current_thread.text, '*host key*')
        )
      )
      // phone number regex
      and any([body.current_thread.text, subject.subject],
              regex.icontains(.,
                              '\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}',
                              '\+?([ilo0-9]{1,2})?\s?\(?\d{3}\)?[\s\.\-⋅]{0,5}[ilo0-9]{3}[\s\.\-⋅]{0,5}[ilo0-9]{4}'
              )
      )
    )
  )

attack_types:
  - "Callback Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Out of band pivot"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Natural Language Understanding"
  - "Sender analysis"
id: "f07b1ca0-de6c-58e4-a695-faf908631049"