Link: .onion From Unsolicited Sender

 1name: "Link: .onion From Unsolicited Sender"
 2description: "Detects messages containing .onion (Tor network) links from unsolicited senders that either lack proper DMARC authentication or are not from trusted domains."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and any(body.links, .href_url.domain.tld == "onion")
 8  and not profile.by_sender_email().solicited
 9  // and the sender is not from high trust sender root domains
10  and not (
11    sender.email.domain.root_domain in $high_trust_sender_root_domains
12    and coalesce(headers.auth_summary.dmarc.pass, false)
13  )  
14tags:
15 - "Attack surface reduction"
16attack_types:
17  - "Malware/Ransomware"
18  - "Credential Phishing"
19tactics_and_techniques:
20  - "Evasion"
21  - "Social engineering"
22detection_methods:
23  - "URL analysis"
24  - "Header analysis"
25  - "Sender analysis"
26id: "9ac0fc83-4c18-5a62-83e0-8fd0af9cffe0"