Low-Signal Pretext Email Followed by Voice Phishing Call to Same Target

let LookbackWindow = 24h;
let CorrelationWindow = 2h;
let PretextKeywords = dynamic(["helpdesk", "help desk", "it support", "service desk", "password expir", "password reset", "vpn access", "account verification", "ticket confirmation", "technical support", "account suspended", "mfa re-enrollment"]);
EmailEvents
| where TimeGenerated > ago(LookbackWindow)
| where (Subject has_any (PretextKeywords) or SenderDisplayName has_any (PretextKeywords))
| where AttachmentCount == 0
| where UrlCount <= 1
| where ThreatTypes !has "Malware" and ThreatTypes !has "Phish"
| project EmailTimestamp = TimeGenerated, RecipientEmailAddress, SenderFromAddress, SenderDisplayName, Subject, NetworkMessageId
| join kind=inner (
    PBXCallLog_CL
    | where TimeGenerated > ago(LookbackWindow)
    | project CallTimestamp = TimeGenerated, RecipientEmailAddress = TargetUserPrincipalName_s, CallerNumber_s, CallDirection_s, CallDurationSeconds_d
    | where CallDirection_s == "Inbound"
  ) on RecipientEmailAddress
| where CallTimestamp between (EmailTimestamp .. EmailTimestamp + CorrelationWindow)
| extend MinutesBetweenEmailAndCall = datetime_diff('minute', CallTimestamp, EmailTimestamp), CorrelationSource = "PBXCallLog"
| project EmailTimestamp, CallTimestamp, MinutesBetweenEmailAndCall, RecipientEmailAddress, SenderFromAddress, Subject, CallerNumber_s, CallDurationSeconds_d, NetworkMessageId, CorrelationSource
| union (
    EmailEvents
    | where TimeGenerated > ago(LookbackWindow)
    | where (Subject has_any (PretextKeywords) or SenderDisplayName has_any (PretextKeywords))
    | where AttachmentCount == 0
    | where UrlCount <= 1
    | where ThreatTypes !has "Malware" and ThreatTypes !has "Phish"
    | project EmailTimestamp = TimeGenerated, RecipientEmailAddress, SenderFromAddress, SenderDisplayName, Subject, NetworkMessageId
    | join kind=inner (
        ServiceDeskAudit_CL
        | where TimeGenerated > ago(LookbackWindow)
        | where Action_s in ("TicketCreated", "TicketUpdated", "PasswordReset", "MFAReset")
        | project TicketTimestamp = TimeGenerated, RecipientEmailAddress = User_s, Agent_s, Action_s
      ) on RecipientEmailAddress
    | where TicketTimestamp between (EmailTimestamp .. EmailTimestamp + CorrelationWindow)
    | extend MinutesBetweenEmailAndCall = datetime_diff('minute', TicketTimestamp, EmailTimestamp), CorrelationSource = "ServiceDeskTicket"
    | project EmailTimestamp, CallTimestamp = TicketTimestamp, MinutesBetweenEmailAndCall, RecipientEmailAddress, SenderFromAddress, Subject, CallerNumber_s = Agent_s, CallDurationSeconds_d = real(null), NetworkMessageId, CorrelationSource
  )
| sort by EmailTimestamp desc

search index=email sourcetype="o365:management:activity" Operation="MailItemsAccessed" OR Operation="Send"
| eval PretextKeywords="helpdesk|help desk|it support|service desk|password expir|password reset|vpn access|account verification|ticket confirmation|technical support|account suspended|mfa re-enrollment"
| where match(lower(Subject), PretextKeywords) OR match(lower(SenderDisplayName), PretextKeywords)
| where AttachmentCount=0 AND UrlCount<=1
| eval EmailTimestamp=_time
| join type=inner RecipientEmailAddress
    [ search index=telephony sourcetype="pbx:call:log" CallDirection="Inbound"
      | rename TargetUserPrincipalName as RecipientEmailAddress, _time as CallTimestamp
      | fields RecipientEmailAddress, CallTimestamp, CallerNumber, CallDurationSeconds ]
| eval MinutesBetweenEmailAndCall=round((CallTimestamp - EmailTimestamp)/60, 1)
| where MinutesBetweenEmailAndCall >= 0 AND MinutesBetweenEmailAndCall <= 120
| eval CorrelationSource="PBXCallLog"
| table EmailTimestamp, CallTimestamp, MinutesBetweenEmailAndCall, RecipientEmailAddress, SenderFromAddress, Subject, CallerNumber, CallDurationSeconds, CorrelationSource
| append
  [ search index=email sourcetype="o365:management:activity" Operation="MailItemsAccessed" OR Operation="Send"
    | eval PretextKeywords="helpdesk|help desk|it support|service desk|password expir|password reset|vpn access|account verification|ticket confirmation|technical support|account suspended|mfa re-enrollment"
    | where match(lower(Subject), PretextKeywords) OR match(lower(SenderDisplayName), PretextKeywords)
    | where AttachmentCount=0 AND UrlCount<=1
    | eval EmailTimestamp=_time
    | join type=inner RecipientEmailAddress
        [ search index=servicedesk sourcetype="ticketing_audit" Action IN ("TicketCreated","TicketUpdated","PasswordReset","MFAReset")
          | rename User as RecipientEmailAddress, _time as TicketTimestamp
          | fields RecipientEmailAddress, TicketTimestamp, Agent, Action ]
    | eval MinutesBetweenEmailAndCall=round((TicketTimestamp - EmailTimestamp)/60, 1)
    | where MinutesBetweenEmailAndCall >= 0 AND MinutesBetweenEmailAndCall <= 120
    | eval CorrelationSource="ServiceDeskTicket", CallerNumber=Agent
    | table EmailTimestamp, TicketTimestamp, MinutesBetweenEmailAndCall, RecipientEmailAddress, SenderFromAddress, Subject, CallerNumber, CorrelationSource ]
| sort - EmailTimestamp

sequence by user.email with maxspan=2h
  [email where event.category == "email" and
    email.attachments.file.size == null and
    (email.subject : ("*helpdesk*", "*help desk*", "*password reset*", "*vpn access*", "*account verification*", "*service desk*"))
  ]
  [network where event.category == "network" and event.dataset == "pbx.call" and network.direction == "inbound"]

SELECT
  e."EmailTime" AS EmailTimestamp, c."CallTime" AS CallTimestamp,
  e."RecipientEmailAddress", e."Subject", c."CallerNumber",
  (c."CallTime" - e."EmailTime") AS SecondsBetween
FROM (
  SELECT devicetime AS "EmailTime", "RecipientEmailAddress", "Subject"
  FROM events
  WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%email%'
    AND ("Subject" ILIKE '%helpdesk%' OR "Subject" ILIKE '%password reset%' OR "Subject" ILIKE '%vpn access%' OR "Subject" ILIKE '%service desk%')
  LAST 24 HOURS
) e
JOIN (
  SELECT devicetime AS "CallTime", "TargetUserPrincipalName" AS "RecipientEmailAddress", "CallerNumber"
  FROM events
  WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%pbx%' AND "CallDirection" = 'Inbound'
  LAST 24 HOURS
) c
ON e."RecipientEmailAddress" = c."RecipientEmailAddress"
WHERE (c."CallTime" - e."EmailTime") BETWEEN 0 AND 7200
ORDER BY e."EmailTime" DESC
LAST 24 HOURS

_sourceCategory=*email*
| json auto
| where matches(Subject, "helpdesk|password reset|vpn access|service desk|account verification")
| where AttachmentCount = 0
| save as EmailEvents
| _sourceCategory=*pbx*
| json auto
| where CallDirection = "Inbound"
| join type=inner RecipientEmailAddress=TargetUserPrincipalName
    [ EmailEvents ]
| where (CallTimestamp - EmailTimestamp) >= 0 AND (CallTimestamp - EmailTimestamp) <= 7200
| stats count as CorrelatedCount by RecipientEmailAddress, Subject, CallerNumber
| sort by CorrelatedCount desc

rule vishing_pretext_email_followup {
  meta:
    author = "Detection Engineering"
    description = "Detects a low-signal, pretext-themed email followed within two hours by an inbound PBX call to the same recipient, indicative of a vishing pretext-then-call social engineering attempt"
    severity = "HIGH"
    confidence = "medium"
    mitre_attack = "T1598.004"
    reference = "https://attack.mitre.org/techniques/T1598/004/"

  events:
    $email.metadata.event_type = "EMAIL_TRANSACTION"
    re.regex($email.network.email.subject, `(?i)(helpdesk|help desk|password reset|vpn access|service desk|account verification)`)
    $email.target.user.email_addresses = $recipient

    $call.metadata.event_type = "NETWORK_CONNECTION"
    $call.metadata.product_event_type = "PBX_CALL_INBOUND"
    $call.target.user.email_addresses = $recipient

    $call.metadata.event_timestamp.seconds - $email.metadata.event_timestamp.seconds <= 7200
    $call.metadata.event_timestamp.seconds - $email.metadata.event_timestamp.seconds >= 0

  condition:
    $email and $call
}

#event_simpleName=EmailReceived
| Subject=/(?i)(helpdesk|help desk|password reset|vpn access|service desk|account verification)/
| AttachmentCount=0
| rename(field="RecipientEmailAddress", as="CorrelationKey")
| join(query={#event_simpleName=PbxCallInbound | rename(field="TargetUserPrincipalName", as="CorrelationKey")}, field=[CorrelationKey], key=CorrelationKey, mode=inner)
| SecondsBetween := CallTimestamp - EmailTimestamp
| test(SecondsBetween >= 0 && SecondsBetween <= 7200)
| table([EmailTimestamp, CallTimestamp, CorrelationKey, Subject, CallerNumber, SecondsBetween])
| sort(EmailTimestamp, order=desc)