Link: Romance/Sexual Language With Suspicious Link
Detects messages containing romantic or adult-themed language, combined with links to newly registered domains or suspicious reply-to addresses.
Sublime rule (View on GitHub)
1name: "Link: Romance/Sexual Language With Suspicious Link"
2description: "Detects messages containing romantic or adult-themed language, combined with links to newly registered domains or suspicious reply-to addresses."
3type: "rule"
4severity: "low"
5source: |
6 type.inbound
7 and length(body.previous_threads) == 0
8 and any(ml.nlu_classifier(body.current_thread.text).topics,
9 .name in ("Romance", "Sexually Explicit Messages")
10 and .confidence == "high"
11 )
12 and 1 of (
13 any(body.links, network.whois(.href_url.domain).days_old < 30),
14 any(body.links, .href_url.domain.root_domain in $url_shorteners),
15 any(headers.reply_to, network.whois(.email.domain).days_old < 30)
16 )
17 and 0 < length(distinct(body.links,
18 .href_url.domain.root_domain not in ("aka.ms")
19 )
20 ) < 3
21 and all(body.links,
22 .href_url.domain.root_domain != sender.email.domain.root_domain
23 )
24
25attack_types:
26 - "Spam"
27tactics_and_techniques:
28 - "Social engineering"
29detection_methods:
30 - "Content analysis"
31 - "Header analysis"
32 - "URL analysis"
33 - "Whois"
34id: "d5694cae-bee8-588e-8123-2c3e3459118b"