Link: Fake Cloudflare verification landing page

 1name: "Link: Fake Cloudflare verification landing page"
 2description: "Detects inbound messages sent to undisclosed or empty recipient lists with no CC and a small number of embedded links, where at least one link resolves to a landing page with an empty href and loads the Cloudflare Insights beacon script."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    any(recipients.to, .email.domain.valid == false) or length(recipients.to) == 0
 9  )
10  and length(recipients.cc) == 0
11  and 0 < length(distinct(body.links, .href_url.url)) < 8
12  and any(body.links,
13          any(html.xpath(ml.link_analysis(.).final_dom, '//a').nodes,
14              .display_text == "Why am I seeing this page?"
15              and strings.contains(.raw, 'href="#"')
16          )
17          and any(ml.link_analysis(.).unique_urls_accessed,
18                  .domain.domain == "static.cloudflareinsights.com"
19                  and strings.contains(.path, "/beacon.min.js/")
20          )
21  )  
22attack_types:
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Social engineering"
26detection_methods:
27  - "URL analysis"
28  - "HTML analysis"
29  - "Header analysis"
30  - "Content analysis"
31id: "976504d6-5586-50bd-b301-a850c9495d3f"