Service abuse: Self-service platform redirecting to newly registered suspicious domain

 1name: "Service abuse: Self-service platform redirecting to newly registered suspicious domain"
 2description: "Detects inbound emails containing links to self-service creation platforms that ultimately redirect to newly registered domains (less than 30 days old) using suspicious top-level domains, indicating potential abuse of legitimate services."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .href_url.domain.root_domain in $self_service_creation_platform_domains
 9          and (
10            // anchors present in the rendered DOM
11            any(ml.link_analysis(.).final_dom.links,
12                network.whois(.href_url.domain).days_old < 30
13                and .href_url.domain.tld in $suspicious_tlds
14            )
15            // or links rendered client-side, which never become anchors in final_dom.links
16            or any(filter(regex.iextract(ml.link_analysis(.).final_dom.raw,
17                                         'https:[/\\]+(?P<host>[a-z0-9][a-z0-9.-]{2,60}\.[a-z]{2,12})'
18                          ),
19                          strings.parse_domain(.named_groups["host"]).tld in $suspicious_tlds
20                          and strings.parse_domain(.named_groups["host"]).root_domain not in $tranco_1m
21                   ),
22                   network.whois(strings.parse_domain(.named_groups["host"])).days_old < 30
23            )
24          )
25  )  
26tags:
27  - "Attack surface reduction" 
28attack_types:
29  - "Credential Phishing"
30tactics_and_techniques:
31  - "Out of band pivot"
32  - "Evasion"
33detection_methods:
34  - "URL analysis"
35  - "Whois"
36  - "HTML analysis"
37id: "c4c38bbe-9d77-5040-9e78-92f2d50b3806"