Link: Recipient domain in URL path

 1name: "Link: Recipient domain in URL path"
 2description: "This rule detects URL paths which contain the recipient SLD multiple times. This has been observed in multiple credential phishing campaigns with MFA enrollment themed lures."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // 
 8  and not profile.by_sender().solicited
 9  // not high trust sender domains
10  and not (
11    sender.email.domain.root_domain in $high_trust_sender_root_domains
12    and coalesce(headers.auth_summary.dmarc.pass, false)
13  )
14  and 
15  // any of the body links, contain the recipient domain repeating multiple times in a link path
16  any(
17      // make a list of distinct email slds
18      distinct(map(recipients.to, .email.domain.sld)),
19      // take the list of slds and cat it into a string of /sld/sld/ and search for it in links
20      any(body.links,
21          strings.icontains(.href_url.path, strings.concat("/", .., "/", .., "/"))
22      )
23  )  
24attack_types:
25  - "Credential Phishing"
26tactics_and_techniques:
27  - "Lookalike domain"
28detection_methods:
29  - "Header analysis"
30  - "Sender analysis"
31  - "URL analysis"
32id: "de08731f-5fce-56bc-91b3-53b40d99278e"