New link domain (<=10d) from untrusted sender

 1name: "New link domain (<=10d) from untrusted sender"
 2description: |
 3    Detects links in the body of an email where the linked domain is less than 10 days old from untrusted senders.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  and length(body.links) > 0
 9  and any(body.links,
10          network.whois(.href_url.domain).days_old <= 10
11          // Mimecast link logic
12          or (
13            .href_url.domain.root_domain in (
14              "mimecastprotect.com",
15              "mimecast.com"
16            )
17            and any(.href_url.query_params_decoded['domain'],
18                    network.whois(strings.parse_domain(.)).days_old <= 10
19            )
20          )
21  )
22  and (
23    (
24      profile.by_sender().prevalence in ("new", "outlier")
25      and not profile.by_sender().solicited
26    )
27    or profile.by_sender().any_messages_malicious_or_spam
28  )
29  // negate senders which have had previous messages marked as benign which pass auth
30  and not (
31    profile.by_sender().any_messages_benign
32    and profile.by_sender().auth_failed == false
33  )  
34tags:
35  - "Attack surface reduction"
36attack_types:
37  - "Credential Phishing"
38  - "Malware/Ransomware"
39detection_methods:
40  - "Sender analysis"
41  - "URL analysis"
42  - "Whois"
43id: "4805b0e6-6d35-512b-8053-87dd0edacc8a"