Attachment: Excel file with hyperlinks to suspicious domains

calendar Sep 11, 2026  ·
Share on: linkedin copy

Flags inbound emails that show signs of business email compromise or credential theft intent—either through NLU classification or language like 'your review'/'please review'—and include an Excel attachment. The attachment is exploded and its exiftool metadata inspected for embedded hyperlinks, which are then parsed and checked against lists of free subdomain hosts, free file hosts, suspicious TLDs, and URL shorteners.

Sublime rule (View on GitHub)

 1name: "Attachment: Excel file with hyperlinks to suspicious domains"
 2description: "Flags inbound emails that show signs of business email compromise or credential theft intent—either through NLU classification or language like 'your review'/'please review'—and include an Excel attachment. The attachment is exploded and its exiftool metadata inspected for embedded hyperlinks, which are then parsed and checked against lists of free subdomain hosts, free file hosts, suspicious TLDs, and URL shorteners."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    any(ml.nlu_classifier(body.current_thread.text).intents,
 9        .name in ('bec', 'cred_theft') and .confidence != 'low'
10    )
11    or strings.icontains(body.current_thread.text, 'your review', 'please review')
12  )
13  and any(attachments,
14          .file_extension in~ ("xls")
15          //
16          // This rule makes use of a beta feature and is subject to change without notice
17          // using the beta feature in custom rules is not suggested until it has been formally released
18          //
19          and any(beta.parse_exif(.).fields,
20                  .key == "Hyperlinks"
21                  and any(strings.parse_json(.value),
22                          (
23                            strings.parse_url(.).domain.domain in $free_subdomain_hosts
24                            or strings.parse_url(.).domain.root_domain in $free_file_hosts
25                            or strings.parse_url(.).domain.tld in $suspicious_tlds
26                            or strings.parse_url(.).domain.root_domain in $url_shorteners
27                            or strings.parse_url(.).domain.domain in $url_shorteners
28                          )
29                  )
30          )
31  )  
32attack_types:
33  - "BEC/Fraud"
34  - "Credential Phishing"
35tactics_and_techniques:
36  - "Free file host"
37  - "Free subdomain host"
38  - "Social engineering"
39detection_methods:
40  - "Natural Language Understanding"
41  - "Content analysis"
42  - "Exif analysis"
43  - "File analysis"
44  - "URL analysis"
45id: "29377257-49c8-5df8-865c-d0b1eba3cad5"
to-top