Service abuse: Soundestlink.com Microsoft impersonation

calendar Aug 17, 2026  ·
Share on: linkedin copy

Detects links or extracted domains hosted on soundestlink.com where the subdomain contains Microsoft-related keywords such as 'microsoft', 'teams', 'login', 'office', '365', or 'outlook'. This pattern indicates abuse of a legitimate link redirection/tracking service to disguise malicious URLs as Microsoft login or authentication pages, a common technique used to harvest credentials.

Sublime rule (View on GitHub)

 1name: "Service abuse: Soundestlink.com Microsoft impersonation"
 2description: "Detects links or extracted domains hosted on soundestlink.com where the subdomain contains Microsoft-related keywords such as 'microsoft', 'teams', 'login', 'office', '365', or 'outlook'. This pattern indicates abuse of a legitimate link redirection/tracking service to disguise malicious URLs as Microsoft login or authentication pages, a common technique used to harvest credentials."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    // parsed urls
 9    any(body.links,
10        (
11          .href_url.domain.root_domain == "soundestlink.com"
12          and regex.icontains(.href_url.domain.subdomain,
13                              '(?:microsoft|teams|login|office|365|outlook)'
14          )
15        )
16        // handle mimecast
17        or (
18          .href_url.domain.root_domain in ("mimecastprotect.com", "mimecast.com")
19          and any(.href_url.query_params_decoded['domain'],
20                  strings.parse_domain(.).root_domain == "soundestlink.com"
21                  and regex.icontains(strings.parse_domain(.).subdomain,
22                                      '(?:microsoft|teams|login|office|365|outlook)'
23                  )
24          )
25        )
26    )
27    // unparsed and extracted
28    or (
29      strings.icontains(body.html.display_text, 'soundestlink.com')
30      and any(regex.extract(body.html.display_text,
31                            '(?P<domain>[a-z0-9.\-]+\.soundestlink\.com)'
32              ),
33              regex.icontains(strings.parse_domain(.named_groups["domain"]).subdomain,
34                              '(?:microsoft|teams|login|office|365|outlook)'
35              )
36      )
37    )
38  )  
39attack_types:
40  - "Credential Phishing"
41tactics_and_techniques:
42  - "Impersonation: Brand"
43  - "Lookalike domain"
44  - "Social engineering"
45detection_methods:
46  - "URL analysis"
47  - "Content analysis"
48  - "HTML analysis"
49id: "2dcd961f-c397-5519-9ff3-d5653a893744"
to-top