Link: Zoho form link from unsolicited sender

 1name: "Link: Zoho form link from unsolicited sender"
 2description: "This detection rule matches on messages containing at least one link to forms.zohopublic.com from an unsolicited sender. Zoho provides a free plan enabling users to create custom websites and file hosting. This service has been abused by threat actors to host landing pages via forms directing victims to a next stage of credential phishing."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    // filter links to zoho forms
 9    any(filter(body.links,
10               // zoho forms link, zfrmz.com is the short form domain
11               .href_url.domain.domain in ('forms.zohopublic.com', 'zfrmz.com')
12               // remove a common FP for linking directly
13               and not strings.istarts_with(.href_url.path, '/quickbooking/')
14        ),
15        // remove FPs by checking there is only one link
16        // ensure the link is within the current_thread
17        (
18          strings.contains(body.current_thread.text, .display_text)
19          or strings.contains(body.current_thread.text, .href_url.url)
20        )
21        // and ensure that link only occurs once within body.html
22        and (
23          (
24            body.html.raw is not null
25            and (
26              strings.count(body.html.raw, .display_text) == 1
27              or strings.count(body.html.raw, .href_url.url) == 1
28            )
29          )
30          or (
31            // and ensure that link only occurs once within plaintext if html.raw is null
32            body.plain.raw is not null
33            and (
34              strings.count(body.plain.raw, .display_text) == 1
35              or strings.count(body.plain.raw, .href_url.url) == 1
36            )
37          )
38        )
39    )
40    // or the form link is only reachable inside a pdf attachment
41    or any(filter(attachments, .file_type == "pdf"),
42           any(file.explode(.),
43               any(.scan.url.urls,
44                   .domain.domain in ('forms.zohopublic.com', 'zfrmz.com')
45                   and not strings.istarts_with(.path, '/quickbooking/')
46               )
47           )
48    )
49  )
50  
51  // dont match messages with lots of links or long bodies, often marketing messages
52  and length(body.links) < 20
53  and coalesce(length(body.current_thread.text), 0) < 900
54  // not solicited or from malicious/spam user with no FPs
55  and (
56    not profile.by_sender().solicited
57    or (
58      profile.by_sender().any_messages_malicious_or_spam
59      and not profile.by_sender().any_messages_benign
60    )
61  )
62  
63  // not from high trust sender root domains
64  and not (
65    sender.email.domain.root_domain in $high_trust_sender_root_domains
66    and coalesce(headers.auth_summary.dmarc.pass, false)
67  )  
68attack_types:
69  - "Callback Phishing"
70tactics_and_techniques:
71  - "Free file host"
72detection_methods:
73  - "Content analysis"
74  - "URL analysis"
75  - "Sender analysis"
76id: "eb04a9f2-c40b-5fcc-97de-bee7111bc3d8"