Detecting Callback Phishing and TOAD

In telephone-oriented attack delivery the email carries no link or attachment, only an invoice, subscription renewal or fraud alert with a number to call. A scammer on the line walks the victim into installing a remote-access tool. Content scanners find little, so detection leans on message shape and on endpoint telemetry for remote tools.

Signals at a Glance

Message Shape

Without a payload, hunt on the combination of urgency subject, no links, no attachments and an external sender the recipient has not seen before. Treat the output as a hunt list to enrich, not an alert on its own:

// Defender XDR (KQL) - payload-free external mail with a billing lure
let withUrl = EmailUrlInfo | where Timestamp > ago(7d) | distinct NetworkMessageId;
let withAtt = EmailAttachmentInfo | where Timestamp > ago(7d) | distinct NetworkMessageId;
EmailEvents
| where Timestamp > ago(7d)
| where EmailDirection == "Inbound" and DeliveryAction == "Delivered"
| where Subject matches regex @"(?i)(invoice|receipt|renewal|subscription|payment|charge|order|refund|fraud)"
| join kind=leftanti withUrl on NetworkMessageId
| join kind=leftanti withAtt on NetworkMessageId
| summarize recipients=dcount(RecipientEmailAddress), subjects=make_set(Subject, 3)
          by SenderFromDomain, SenderIPv4
| where recipients >= 3
| order by recipients desc
// tune/validate: transactional mail from real vendors lacks links too; allowlist known billers

The Remote Tool Follows the Call

The compromise begins when the caller guides the victim through installing or enabling a remote tool. Build a list of sanctioned remote-access software and alert on every other tool, especially on user workstations in the hours after a lure hits:

// Defender XDR (KQL) - remote-access tools started on endpoints outside the approved set
let approved = dynamic(["teamviewer.exe"]);    // replace with your sanctioned tools
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("quickassist.exe","anydesk.exe","screenconnect.clientservice.exe","screenconnect.windowsclient.exe",
                      "atera agent.exe","splashtopstreamer.exe","rustdesk.exe","remoteutilities.exe","teamviewer.exe")
| where FileName !in~ (approved)
| summarize firstSeen=min(Timestamp), launches=count(), parents=make_set(InitiatingProcessFileName, 3)
          by DeviceName, AccountName, FileName
| order by firstSeen desc
// tune/validate: Quick Assist ships with Windows; consider blocking it for users with no help-desk role

• Block or restrict Quick Assist and unsanctioned remote tools with application control, and document the approved one in the help-desk script.
• Give help desk and users a verification rule: IT will never ask you to install remote software after you phone a number in an email.
• Restrict external Teams or chat contact to allowed tenants, and monitor for new external senders using help-desk names.
• Pull the phone numbers from lures into a block list for corporate softphones where you can.