Link: Direct link to limewire hosted file

 1name: "Link: Direct link to limewire hosted file"
 2description: "Message contains exactly one link to limewire.com domain with fewer than 10 total links in the body."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // there are few links
 8  and length(body.links) < 10
 9  // contains a link to limewire
10  and any(body.links, .href_url.domain.domain == "limewire.com")
11  // is the only link to limewire
12  and length(filter(body.links,
13                    .href_url.domain.root_domain == "limewire.com"
14                    and strings.istarts_with(.href_url.path, "/d/")
15             )
16  ) == 1
17  and not length(body.previous_threads) > 0
18  // negate highly trusted sender domains unless they fail DMARC authentication
19  and not (
20    sender.email.domain.root_domain in $high_trust_sender_root_domains
21    and coalesce(headers.auth_summary.dmarc.pass, false)
22  )
23  and not profile.by_sender_email().any_messages_benign  
24tags:
25 - "Attack surface reduction"
26attack_types:
27  - "Malware/Ransomware"
28tactics_and_techniques:
29  - "Free file host"
30detection_methods:
31  - "URL analysis"
32  - "Content analysis"
33id: "70840d00-c6e3-59ec-8dc5-8156e61abec6"