Link: Copy-paste browser instruction with suspicious domain

 1name: "Link: Copy-paste browser instruction with suspicious domain"
 2description: "Flags inbound messages that instruct the recipient to copy or paste a URL into their web browser, then examines the surrounding text for a bare (non-hyperlinked) hostname. The rule triggers when that domain is not linked anywhere else in the message, does not match the sender's own domain, and is hosted on a known free subdomain host—patterns consistent with attempts to bypass automated URL scanning by avoiding clickable hyperlinks."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // window of lines around a copy/paste-into-browser instruction
 8  and any(regex.iextract(body.current_thread.text,
 9                         '(?P<window>(?:[^\n]*\n){0,2}[^\n]*(?:cop(?:y|ied)|past(?:e|ed))\b[^\n]{0,50}?\b(?:in|into|to)\s+(?:your|a|the|any)\s+(?:web\s+)?browser[^\n]*(?:\n[^\n]*){0,3})'
10          ),
11          // bare hostnames within that window, parsed once
12          any(map(regex.iextract(.named_groups["window"],
13                                 '(?:^|[\s:(])(?P<host>[a-z0-9-]+(?:\.[a-z0-9-]+)+\.[a-z]{2,})(?:/\S*)?(?:[\s.,;)!]|$)'
14                  ),
15                  strings.parse_url(strings.concat("https://",
16                                                   .named_groups["host"]
17                                    )
18                  ).domain
19              ),
20              .valid
21              // never hyperlinked anywhere in the message and not the sender's own domain
22              and .root_domain not in map(body.links,
23                                          .href_url.domain.root_domain
24              )
25              and .root_domain !~ sender.email.domain.root_domain
26              // free app hosting
27              and .root_domain in $free_subdomain_hosts
28          )
29  )  
30attack_types:
31  - "Credential Phishing"
32tactics_and_techniques:
33  - "Evasion"
34  - "Free subdomain host"
35  - "Social engineering"
36detection_methods:
37  - "Content analysis"
38  - "URL analysis"
39  - "Sender analysis"
40id: "bfe2afff-3db1-5195-80bb-dac3d7d3b089"