Link: Romance/Sexual Language With Suspicious Link

 1name: "Link: Romance/Sexual Language With Suspicious Link"
 2description: "Detects messages containing romantic or adult-themed language, combined with links to newly registered domains or suspicious reply-to addresses."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and length(body.previous_threads) == 0
 8  and any(ml.nlu_classifier(body.current_thread.text).topics,
 9          .name in ("Romance", "Sexually Explicit Messages")
10          and .confidence == "high"
11  )
12  and 1 of (
13    any(body.links, network.whois(.href_url.domain).days_old < 30),
14    any(body.links, .href_url.domain.root_domain in $url_shorteners),
15    any(body.links, .href_url.domain.domain in $free_subdomain_hosts),
16    any(body.links,
17        .href_url.domain.tld in ('ru', 'app', 'digital', 'click', 'garden')
18    ),
19    any(headers.reply_to, network.whois(.email.domain).days_old < 30),
20    any(body.links,
21        length(.href_url.domain.subdomain) > 3
22        and (
23          strings.iends_with(.href_url.path,
24                             strings.concat('/', .href_url.domain.subdomain)
25          )
26        )
27    )
28  )
29  and all(body.links,
30          .href_url.domain.root_domain != sender.email.domain.root_domain
31  )  
32
33attack_types:
34  - "Spam"
35tactics_and_techniques:
36  - "Social engineering"
37detection_methods:
38  - "Content analysis"
39  - "Header analysis"
40  - "URL analysis"
41  - "Whois"
42id: "d5694cae-bee8-588e-8123-2c3e3459118b"