Link: Large guest list with suspicious link

 1name: "Link: Large guest list with suspicious link"
 2description: "Detects inbound messages containing a large guest list alongside a suspicious link"
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(body.current_thread.text,
 8                       '(Guest list is too large to display)',
 9                       '(Gästeliste zu groß zum Anzeigen)',
10                       '(La liste des invités est trop longue pour être affichée)',
11                       '(La liste des invités est trop importante pour être affichée)',
12                       '(Список гостей слишком велик, невозможно отобразить его полностью)',
13                       '(Elenco invitati troppo lungo per la visualizzazione)',
14                       '(A lista de convidados é muito grande para ser exibida)',
15                       '(Gæstelisten er for lang til at blive vist)'
16  )
17  and any(body.current_thread.links,
18          (
19            .href_url.path == '/'
20            and regex.imatch(.href_url.query_params, '[A-Za-z0-9+/]{8}')
21            and length(.href_url.query_params_decoded) == 1
22            and all(flatten(values(.href_url.query_params_decoded)), . == '')
23          )
24          or any(ml.link_analysis(.).final_dom.links,
25                 .href_url.path == '/'
26                 and regex.imatch(.href_url.query_params, '[A-Za-z0-9+/]{8}')
27                 and length(.href_url.query_params_decoded) == 1
28                 and all(flatten(values(.href_url.query_params_decoded)), . == '')
29          )
30          or ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain in (
31            'workers.dev'
32          )
33          or length(filter(.href_url.rewrite.encoders,
34                           . != 'google_open_redirect'
35                    )
36          ) > length(distinct(filter(.href_url.rewrite.encoders,
37                                     . != 'google_open_redirect'
38                              )
39                     )
40          )
41          or (
42            strings.contains(.display_url.url, 'drive.google.com')
43            and .mismatched == true
44          )
45          // minimal js landing page
46          or length(filter(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
47                           .url == ..href_url.url
48                           or (
49                             strings.starts_with(.url, ..href_url.url)
50                             and regex.icontains(.url,
51                                                 '[a-z]{3,}\.[0-9a-f]{20}\.js'
52                             )
53                           )
54                           or .url == strings.concat(..href_url.url,
55                                                     'favicon.png'
56                           )
57                           or .url == strings.concat('https://',
58                                                     ..href_url.domain.domain,
59                                                     '/',
60                                                     'favicon.ico'
61                           )
62                    )
63          ) == 3
64  )  
65attack_types:
66  - "Credential Phishing"
67tactics_and_techniques:
68  - "Evasion"
69  - "Social engineering"
70detection_methods:
71  - "Content analysis"
72  - "URL analysis"
73id: "f2e73678-90c5-530e-a70c-8e043e18400d"