Link: Suspicious TLD hosting client.js with cf beacon

 1name: "Link: Suspicious TLD hosting client.js with cf beacon"
 2description: "Flags inbound messages with no visible recipients and a small number of body links, one of which resolves to a suspicious TLD and loads a self-hosted client.js file."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    any(recipients.to, .email.domain.valid == false) or length(recipients.to) == 0
 9  )
10  and length(recipients.cc) == 0
11  and 0 < length(body.links) < 8
12  and sender.email.domain.tld not in $suspicious_tlds
13  and any(body.links,
14          not .display_text is null
15          and ml.link_analysis(.).effective_url.domain.tld in $suspicious_tlds
16          and any(ml.link_analysis(.).unique_urls_accessed,
17                  // client.js hosted on the suspect domain
18                  .domain.domain == ml.link_analysis(..).effective_url.domain.domain
19                  and .path == "/client.js"
20          )
21          and any(ml.link_analysis(.).unique_urls_accessed,
22                  .domain.domain == "static.cloudflareinsights.com"
23                  and strings.contains(.path, "/beacon.min.js/")
24          )
25  )  
26attack_types:
27  - "Credential Phishing"
28tactics_and_techniques:
29  - "Social engineering"
30  - "Scripting"
31detection_methods:
32  - "URL analysis"
33  - "Content analysis"
34  - "Sender analysis"
35id: "a475d096-0459-5ecc-bfbd-e27f557e66c1"