Link: Deactivated bit.ly link

calendar Aug 21, 2023  ยท
Share on: linkedin copy

Shortened link is blocked by bit.ly. Indicator of malicious email.

Sublime rule (View on GitHub)

 1name: "Link: Deactivated bit.ly link"
 2description: |
 3    Shortened link is blocked by bit.ly. Indicator of malicious email.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  and any(body.links,
 9          // contains bit.ly link
10          .href_url.domain.root_domain == "bit.ly"
11          // link doesn't forward through
12          and beta.linkanalysis(.).effective_url.domain.domain == "bit.ly"
13          // blocked by bit.ly
14          and strings.ilike(beta.linkanalysis(.).final_dom.display_text, "*link*blocked*")
15  )  
16attack_types:
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Evasion"
20detection_methods:
21  - "URL analysis"
22id: "1528eb6c-22fa-5879-b48c-53ee466fde23"
to-top