New sender domain (<=10d) from untrusted sender

calendar Feb 23, 2024 · Attack surface reduction  ·
Share on: linkedin copy

Detects inbound emails where the sender domain is less than 10 days old from untrusted senders.

Sublime rule (View on GitHub)

 1name: "New sender domain (<=10d) from untrusted sender"
 2description: |
 3    Detects inbound emails where the sender domain is less than 10 days old from untrusted senders.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  and beta.whois(sender.email.domain).days_old <= 10
 9  and (
10    (
11      profile.by_sender().prevalence in ("new", "outlier")
12      and not profile.by_sender().solicited
13    )
14    or profile.by_sender().any_messages_malicious_or_spam
15  )
16  and not profile.by_sender().any_false_positives
17    
18tags:
19  - "Attack surface reduction"
20detection_methods:
21  - "Sender analysis"
22  - "Whois"
23id: "d87fa543-aabb-55f5-9660-23c9e7a85b2a"

Related rules

to-top