Link: Mismatched free file host links with document lure

calendar Aug 5, 2026  ·
Share on: linkedin copy

Detects inbound emails containing mismatched hyperlinks where the displayed URL references a free file hosting service but the actual destination points to another free file host or a suspicious TLD. The rule combines this with NLU classification identifying BEC or credential theft intent, along with body text patterns common to fake document/scan notifications (e.g., 'scanned from', 'shared via', 'for your review') or short, urgency-driven messages. Trusted senders with passing DMARC are excluded to reduce false positives.

Sublime rule (View on GitHub)

 1name: "Link: Mismatched free file host links with document lure"
 2description: "Detects inbound emails containing mismatched hyperlinks where the displayed URL references a free file hosting service but the actual destination points to another free file host or a suspicious TLD. The rule combines this with NLU classification identifying BEC or credential theft intent, along with body text patterns common to fake document/scan notifications (e.g., 'scanned from', 'shared via', 'for your review') or short, urgency-driven messages. Trusted senders with passing DMARC are excluded to reduce false positives."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(body.current_thread.links, .mismatched),
 8          any([.display_url.domain.domain, .display_url.domain.root_domain],
 9              . in $free_file_hosts
10          )
11          and (
12            any([.href_url.domain.domain, .href_url.domain.root_domain],
13                . in $free_file_hosts
14            )
15            or .href_url.domain.tld in $suspicious_tlds
16          )
17  )
18  and any(ml.nlu_classifier(body.current_thread.text).intents,
19          .name in ("bec", "cred_theft") and .confidence != "low"
20  )
21  and 2 of (
22    regex.icontains(body.current_thread.text,
23                    'scanned from',
24                    'total images',
25                    'attachment format',
26                    'scan information',
27                    'statement/remittance',
28                    'versalink',
29                    'made a file available',
30                    'document from .{0,40}is available',
31                    '(?:uploaded|shared) via',
32                    '(?:report|available) for your review'
33    ),
34    regex.icontains(body.current_thread.text, '={5,}|_{10,}'),
35    length(body.current_thread.text) < 700,
36    regex.icontains(body.current_thread.text,
37                    'kindly review',
38                    'review the attached',
39                    'let us know the next step',
40                    'for your review',
41                    'please review the'
42    )
43  )
44  and not (
45    sender.email.domain.root_domain in $high_trust_sender_root_domains
46    and coalesce(headers.auth_summary.dmarc.pass, false)
47  )  
48attack_types:
49  - "BEC/Fraud"
50  - "Credential Phishing"
51tactics_and_techniques:
52  - "Free file host"
53  - "Social engineering"
54detection_methods:
55  - "Natural Language Understanding"
56  - "URL analysis"
57  - "Content analysis"
58id: "19836dcf-cde4-5d9a-903f-c74c1e88e33d"
to-top