Service abuse: Soundestlink redirect with suspicious indicators

 1name: "Service abuse: Soundestlink redirect with suspicious indicators"
 2description: "Detects messages containing Soundestlink redirect links that lack proper unsubscribe mechanisms, and lack standard mailing list headers, indicating potential abuse of the service."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .href_url.domain.root_domain == "soundestlink.com"
 9          and not strings.istarts_with(.href_url.path, '/contactsPreferences/')
10  )
11  and length(distinct(filter(body.current_thread.links,
12                             .href_url.domain.root_domain == "soundestlink.com"
13                             and not strings.istarts_with(.href_url.path,
14                                                          '/contactsPreferences/'
15                             )
16                      ),
17                      .href_url.url
18             )
19  ) == 1
20  and not any(headers.hops, any(.fields, .name =~ "List-Unsubscribe"))
21  and not (
22    any(html.xpath(body.html, '//a').nodes, .inner_text =~ "Edit Preferences")
23    and any(html.xpath(body.html, '//a').nodes, .inner_text =~ "Unsubscribe")
24  )  
25
26attack_types:
27  - "Credential Phishing"
28  - "Malware/Ransomware"
29tactics_and_techniques:
30  - "Evasion"
31detection_methods:
32  - "Header analysis"
33  - "HTML analysis"
34id: "e3ca4425-96b4-5acf-9e14-503f359c2838"