
Summary
Detects inbound messages originating from Google’s calendar notification service that contain language indicative of a callback scam, suggesting abuse of the calendar sharing feature to disseminate fraudulent content. The rule asserts that the sender email equals calendar-notification@google.com and uses an NLP classifier on the thread body (body.current_thread.text) to identify intents named
Categories
- Web
Data Sources
- Network Traffic
- Application Log
Created: 2026-03-17