Link: Large guest list with suspicious link

 1name: "Link: Large guest list with suspicious link"
 2description: "Detects inbound messages containing a large guest list alongside a suspicious link"
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(body.current_thread.text,
 8                       '(Guest list is too large to display)',
 9                       '(Gästeliste zu groß zum Anzeigen)'
10  )
11  and any(body.current_thread.links,
12          (
13            .href_url.path == '/'
14            and regex.imatch(.href_url.query_params, '[A-Za-z0-9+/]{8}')
15            and length(.href_url.query_params_decoded) == 1
16            and all(flatten(values(.href_url.query_params_decoded)), . == '')
17          )
18          or any(ml.link_analysis(.).final_dom.links,
19                 .href_url.path == '/'
20                 and regex.imatch(.href_url.query_params, '[A-Za-z0-9+/]{8}')
21                 and length(.href_url.query_params_decoded) == 1
22                 and all(flatten(values(.href_url.query_params_decoded)), . == '')
23          )
24          or ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain in (
25            'workers.dev'
26          )
27          or length(filter(.href_url.rewrite.encoders,
28                           . != 'google_open_redirect'
29                    )
30          ) > length(distinct(filter(.href_url.rewrite.encoders,
31                                     . != 'google_open_redirect'
32                              )
33                     )
34          )
35          or (
36            strings.contains(.display_url.url, 'drive.google.com')
37            and .mismatched == true
38          )
39  )  
40attack_types:
41  - "Credential Phishing"
42tactics_and_techniques:
43  - "Evasion"
44  - "Social engineering"
45detection_methods:
46  - "Content analysis"
47  - "URL analysis"
48id: "f2e73678-90c5-530e-a70c-8e043e18400d"