Link: Free Subdomain host with undisclosed recipients
Detects messages with undisclosed recipients, containing links to free subdomain hosts
Sublime rule (View on GitHub)
1name: "Link: Free Subdomain host with undisclosed recipients"
2description: |
3 Detects messages with undisclosed recipients, containing links to free subdomain hosts
4type: "rule"
5severity: "medium"
6source: |
7 type.inbound
8 and any(body.links,
9 .href_url.domain.root_domain in $free_subdomain_hosts
10 and .href_url.domain.subdomain is not null
11 and .href_url.domain.subdomain != "www"
12 )
13 and (length(recipients.to) == 0 or all(recipients.to, .display_name == "Undisclosed recipients"))
14 and length(recipients.cc) == 0
15 and length(recipients.bcc) == 0
16
17 // negate listmailers & benign threads
18 and not (
19 any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
20 or any(ml.nlu_classifier(body.current_thread.text).intents,
21 .name == "benign" and .confidence == "high"
22 )
23 )
24 and (
25 profile.by_sender().prevalence in ("new", "outlier")
26 or profile.by_sender().any_messages_malicious_or_spam
27 )
28 and not profile.by_sender().any_false_positives
29
30tags:
31 - "Attack surface reduction"
32tactics_and_techniques:
33 - "Free subdomain host"
34detection_methods:
35 - "Header analysis"
36 - "URL analysis"
37id: "c23d979d-de80-599d-b0ca-c7fef217885e"