Link: AWS S3 website hosting credential theft

 1name: "Link: AWS S3 website hosting credential theft"
 2description: "Detects inbound messages containing a link to a domain using Amazon S3 static website hosting (s3-website-*.amazonaws.com) where the message body is classified with high confidence as credential theft by natural language understanding analysis. Threat actors frequently abuse free S3 website hosting to host credential harvesting pages, leveraging the trusted AWS domain to bypass reputation-based filtering."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          regex.icontains(.href_url.domain.domain,
 9                          '\.s3-website[\-.][a-z0-9\-]+\.amazonaws\.com$'
10          )
11  )
12  and any(ml.nlu_classifier(body.current_thread.text).intents,
13          .name == "cred_theft" and .confidence == "high"
14  )  
15tags:
16  - "Attack surface reduction"    
17attack_types:
18  - "Credential Phishing"
19tactics_and_techniques:
20  - "Free file host"
21  - "Social engineering"
22detection_methods:
23  - "Natural Language Understanding"
24  - "URL analysis"
25id: "d17b9a73-f117-5c18-912e-48b930448693"