Link: Suspicious recipient with timeout redirect

 1name: "Link: Suspicious recipient with timeout redirect"
 2description: "Detects inbound messages sent to self, invalid recipients, or undisclosed recipients containing links that, upon analysis, include a JavaScript setTimeout redirect. This technique delays redirection and appends URL fragments to evade static link inspection."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    // self sender or invaild recipent domain or local parts match
 9    (
10      length(recipients.to) == 1
11      and (
12        sender.email.email == recipients.to[0].email.email
13        or recipients.to[0].email.domain.valid == false
14        or sender.email.local_part == recipients.to[0].email.local_part
15      )
16    )
17    // no recipients defined
18    or (
19      (
20        length(recipients.to) == 0
21        or all(recipients.to, .email.domain.valid == false)
22      )
23      and length(recipients.cc) == 0
24      and length(recipients.bcc) == 0
25    )
26  )
27  and 0 < length(body.current_thread.links) < 10
28  and any(body.current_thread.links,
29          any(html.xpath(ml.link_analysis(., mode="aggressive").final_dom,
30                         "//script"
31              ).nodes,
32              strings.istarts_with(.raw,
33                                   '<script>setTimeout(function(){window.location="'
34              )
35              and strings.iends_with(.raw, '"+location.hash},3000)</script>')
36          )
37  )  
38attack_types:
39  - "Credential Phishing"
40tactics_and_techniques:
41  - "Scripting"
42  - "Evasion"
43  - "Social engineering"
44detection_methods:
45  - "URL analysis"
46  - "Javascript analysis"
47  - "HTML analysis"
48  - "Sender analysis"
49id: "05c8c2d1-6018-5a3e-9e20-be1b41796e62"