Twitter infrastructure abuse via link shortener

 1name: "Twitter infrastructure abuse via link shortener"
 2description: "Email contains Twitter shortened link (t.co) but does not originate from a Twitter domain. This is a known malicious and spam tactic."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(body.links) < 10
 8  and any(body.links, .href_url.domain.root_domain == "t.co")
 9  and sender.email.domain.domain not in~ (
10    'twitter.com',
11    'x.com',
12    'twitter.discoursemail.com'
13  )
14  and (
15    not profile.by_sender_email().solicited
16    or (
17      profile.by_sender().any_messages_malicious_or_spam
18      and not profile.by_sender().any_messages_benign
19    )
20  )
21  // negate highly trusted sender domains unless they fail DMARC authentication
22  and not (
23    sender.email.domain.root_domain in $high_trust_sender_root_domains
24    and coalesce(headers.auth_summary.dmarc.pass, false)
25  )  
26
27tags:
28  - "Attack surface reduction"
29attack_types:
30  - "Credential Phishing"
31  - "Malware/Ransomware"
32  - "Spam"
33tactics_and_techniques:
34  - "Evasion"
35  - "Impersonation: Brand"
36  - "Social engineering"
37detection_methods:
38  - "Content analysis"
39  - "Sender analysis"
40  - "URL analysis"
41id: "99ca165e-086a-5dc0-aa75-82446f27955b"