Service abuse: Hotel booking via free form page

 1name: "Service abuse: Hotel booking via free form page"
 2description: "Detects inbound messages that combine conference or event terminology with hotel and reservation language, while linking to a form-building platform disguised as a legitimate booking page."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .href_url.domain.root_domain in $self_service_creation_platform_domains
 9          and regex.icontains(.display_text, '\b(?:book(?:ing)?|hotels?)\b')
10  )
11  
12  // an event housing pitch
13  and regex.icontains(body.current_thread.text,
14                      '\b(?:hotels?|housing|accommodations?|room rates?|reserve your room)\b'
15  )
16  and strings.icontains(body.current_thread.text,
17                        'annual meeting',
18                        'conference',
19                        'congress',
20                        'convention',
21                        'expo',
22                        'forum',
23                        'seminar',
24                        'summit',
25                        'symposium',
26                        'trade show'
27  )
28  
29  // sender profiles
30  and (
31    not profile.by_sender().solicited
32    or (
33      profile.by_sender().any_messages_malicious_or_spam
34      and not profile.by_sender().any_messages_benign
35    )
36  )
37  
38  // negate highly trusted sender domains unless they fail DMARC authentication
39  and not (
40    sender.email.domain.root_domain in $high_trust_sender_root_domains
41    and coalesce(headers.auth_summary.dmarc.pass, false)
42  )  
43attack_types:
44  - "Spam"
45  - "BEC/Fraud"
46tactics_and_techniques:
47  - "Social engineering"
48detection_methods:
49  - "Header analysis"
50  - "Sender analysis"
51  - "Content analysis"
52  - "URL analysis"
53id: "e25d8b91-756b-5439-befa-00226a57593f"