Link: Document-themed link to newly registered domain

calendar Aug 18, 2026  ·
Share on: linkedin copy

Detects inbound emails containing links whose display text mimics a document file (.xlsx, .xls, .pdf, .doc, .docx) but whose resolved destination domain was registered within the last 30 days, a strong indicator of a newly stood-up malicious infrastructure used to harvest credentials or deliver malware.

Sublime rule (View on GitHub)

 1name: "Link: Document-themed link to newly registered domain"
 2description: "Detects inbound emails containing links whose display text mimics a document file (.xlsx, .xls, .pdf, .doc, .docx) but whose resolved destination domain was registered within the last 30 days, a strong indicator of a newly stood-up malicious infrastructure used to harvest credentials or deliver malware."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          strings.ends_with(.display_text,
 9                            '.xlsx',
10                            '.xls',
11                            '.pdf',
12                            '.doc',
13                            '.docx'
14          )
15          and network.whois(ml.link_analysis(., mode="aggressive").effective_url.domain
16          ).days_old <= 30
17  )  
18attack_types:
19  - "Credential Phishing"
20  - "Malware/Ransomware"
21tactics_and_techniques:
22  - "Social engineering"
23  - "Evasion"
24detection_methods:
25  - "URL analysis"
26  - "Whois"
27  - "Content analysis"
28id: "32e634b4-abfa-51b9-ab13-a58c05a3071e"
to-top