Service abuse: Cognito Forms with short body from unknown sender

 1name: "Service abuse: Cognito Forms with short body from unknown sender"
 2description: "Detects messages with a very short body (under 200 characters) that contain a link to Cognito Forms, where the sender is not Cognito Forms itself."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and regex.count(body.html.raw,
 8                  '(?:<(?:p|div)[^>]*>\s*<br>\s*</(?:p|div)>\s*){6,}'
 9  ) >= 1
10  and sender.email.domain.root_domain != "cognitoforms.com"
11  and any(body.current_thread.links,
12          .href_url.domain.root_domain == "cognitoforms.com"
13          and length(.display_text) > 8
14          // negating benign hits
15          and not .display_text =~ "opt-out"
16          and not strings.icontains(.display_text, "cognitoforms.com")
17  )
18  // negating messages which use cognito and other mailing platforms
19  and not any(body.current_thread.links, .display_text =~ "unsubscribe")  
20attack_types:
21  - "Credential Phishing"
22tactics_and_techniques:
23  - "Social engineering"
24detection_methods:
25  - "Content analysis"
26  - "Sender analysis"
27  - "URL analysis"
28id: "d2657717-2ef4-5d9e-8266-472cef985148"