New sender domain (<=10d) from untrusted sender

calendar Nov 20, 2024 · Attack surface reduction  ·
Share on: linkedin copy

Detects inbound emails where the sender domain is less than 10 days old from untrusted senders.

Sublime rule (View on GitHub)

 1name: "New sender domain (<=10d) from untrusted sender"
 2description: |
 3    Detects inbound emails where the sender domain is less than 10 days old from untrusted senders.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  and network.whois(sender.email.domain).days_old <= 10
 9  and not profile.by_sender().solicited  
10tags:
11  - "Attack surface reduction"
12detection_methods:
13  - "Sender analysis"
14  - "Whois"
15id: "d87fa543-aabb-55f5-9660-23c9e7a85b2a"

Related rules

to-top