Service abuse: Microsoft domain with suspicious link

 1name: "Service abuse: Microsoft domain with suspicious link"
 2description: "Detects inbound messages sent through Microsoft's messaging.microsoft.com or office365alerts@microsoft.com infrastructure that contain links with long numeric parameters, base64-like encoded paths, or links that resolve to Cloudflare Turnstile challenges, indicating attempts to obscure the final destination or evade analysis."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and (
 8    sender.email.email == 'office365alerts@microsoft.com'
 9    or sender.email.domain.domain == 'messaging.microsoft.com'
10  )
11  and any(filter(body.current_thread.links, .href_url.scheme != 'mailto'),
12          regex.icontains(.href_url.url, '=\d{15,}', '[a-z]+%[a-z]{4,}')
13          or regex.imatch(.href_url.path, '/[a-z0-9+/]{40,}={0,2}')
14          or any([ml.link_analysis(., mode="aggressive")],
15                 // CF Turnstile
16                 any(.unique_urls_accessed,
17                     .domain.domain == "challenges.cloudflare.com"
18                 )
19                 // or site is down behind Cloudflare
20                 or (
21                   regex.icontains(.final_dom.display_text,
22                                   'error\s*(?:code\s*)?(?:5\d{2}|1\d{3})'
23                   )
24                   and regex.icontains(.final_dom.display_text, 'cloudflare')
25                 )
26          )
27  )
28  and not any(ml.nlu_classifier(body.current_thread.text).topics,
29              .name in ("Advertising and Promotions")
30  )  
31attack_types:
32  - "Credential Phishing"
33tactics_and_techniques:
34  - "Evasion"
35  - "Social engineering"
36detection_methods:
37  - "URL analysis"
38  - "Content analysis"
39  - "Sender analysis"
40id: "fca5ddba-df52-546f-9683-6800f5d23fff"