This rule detects inbound messages that originate from statuspage.io's notification address noreply@statuspage.io and uses a natural language understanding (NLU) model to classify the message body. Specifically, it analyzes body.current_thread.text with ml.nlu_classifier and looks for an intent named callback_scam whose confidence is not 'low' (i.e., medium or high). When such an intent is present, the rule flags the message as a potential callback scam, leveraging a legitimate service channel to deliver a phishing lure. The rule is categorized with medium severity and focuses on detecting social engineering attempts that impersonate trusted infrastructure communications. Detection methods include NLU-based content analysis and sender verification. Attack types include Callback Phishing, with tactics and techniques centered on social engineering and spoofing. This rule helps identify campaigns that abuse trusted notification channels to prompt callbacks or actions that could lead to credential theft or other exploits. Notes: maintain awareness of possible false positives if legitimate statuspage communications trigger similar intents, and consider complementing with domain alignment checks, SPF/DKIM/DMARC checks, and corroborating context from the recipient’s environment.