New sender domain (<=10d) from first-time sender

 1name: "New sender domain (<=10d) from first-time sender"
 2description: |
 3    Detects inbound emails where the sender domain is less than 10 days old from first-time senders.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  and beta.whois(sender.email.domain).days_old <= 10
 9  and (
10    (
11      sender.email.domain.root_domain in $free_email_providers
12      and sender.email.email not in $sender_emails
13    )
14    or (
15      sender.email.domain.root_domain not in $free_email_providers
16      and sender.email.domain.domain not in $sender_domains
17    )
18  )  
19tags:
20  - "Attack surface reduction"
21detection_methods:
22  - "Sender analysis"
23  - "Whois"
24id: "d87fa543-aabb-55f5-9660-23c9e7a85b2a"