Link: Echo-tail od= affiliate tracking token

 1name: "Link: Echo-tail od= affiliate tracking token"
 2description: "Detects links carrying a known affiliate tracking token pattern. Observed in account suspension, payment and prize spam."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          regex.contains(.href_url.url,
 9                         '[?&]od=[0-9][a-z]{2,3}[0-9A-Za-z_]*[./][0-9a-z]{6,7}[./][a-z]{0,3}[A-Z][0-9a-z]{10,24}_x[a-z]{0,3}\d{3,5}[a-z]{0,3}[./][0-9a-z]{5}[A-Za-z0-9+/_\]]{14,}'
10          )
11  )  
12attack_types:
13  - "Spam"
14tactics_and_techniques:
15  - "Free file host"
16  - "Evasion"
17detection_methods:
18  - "URL analysis"
19id: "7ac9ef7e-b54c-5e57-a6d3-a222d06a4ca5"