Link: Abused Trac-link URL

 1name: "Link: Abused Trac-link URL"
 2description: "Detects messages containing links to trac-link.com, in either the body or PDF attachments, that are not traversing Easymail's service. This has been observed in malicious/spam campaigns."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    // body links
 9    (
10      any(body.current_thread.links,
11          .href_url.domain.root_domain == "trac-link.com"
12          and strings.istarts_with(.href_url.path, '/api/mail-track/link/')
13      )
14      // negate legitimate service traversal
15      and not strings.icontains(body.html.raw,
16                                'https://storage.googleapis.com/easymails'
17      )
18    )
19  
20    // attachment links
21    or any(attachments,
22           (.file_extension == "pdf" or .file_type == "pdf")
23           and any(file.explode(.),
24                   any(.scan.pdf.urls, .domain.root_domain == "trac-link.com")
25           )
26    )
27  )  
28
29attack_types:
30  - "Credential Phishing"
31tactics_and_techniques:
32  - "Open redirect"
33  - "Evasion"
34  - "PDF"
35detection_methods:
36  - "URL analysis"
37  - "File analysis"
38  - "Content analysis"
39id: "b00f3aa4-aae4-5353-a8a4-508a580cd1aa"