Service abuse: Zoom Clips with suspicious reply-to address or links

 1name: "Service abuse: Zoom Clips with suspicious reply-to address or links"
 2description: "Detects legitimate-looking Zoom 'Clips shared' notifications sent from Zoom's genuine no-reply infrastructure, where the underlying reply-to address or embedded links show signs of abuse. This includes reply-to domains that very recently created, links pointing to scheduling services like Cal.com, Calendly, or Vasta, or unsolicited reply-to senders — all indicating the legitimate clip-sharing feature is being leveraged to route victims to attacker-controlled contact points."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // Legitimate zoom sending infrastructure
 8  and sender.email.email == "no-reply@zoom.us"
 9  // sharing a clip
10  and (
11    // as determiend by the subject
12    strings.starts_with(subject.base, 'Clips')
13    // or by a link
14    or any(body.links,
15           .href_url.domain.root_domain == "zoom.us"
16           and strings.istarts_with(.href_url.path, '/clips/share')
17    )
18  )
19  and (
20    // reply-to domain is not registered
21    network.whois(headers.reply_to[0].email.domain).found == false
22    // recently registered
23    or network.whois(headers.reply_to[0].email.domain).days_old <= 90
24    // links it cal.com
25    or any(body.links,
26           .href_url.domain.root_domain in ('cal.com', 'calendly.com', 'vasta.me')
27           // the link domain is newer than 90 days
28           or network.whois(.href_url.domain).days_old < 90
29    )
30  
31    // the reply to address is not soliticed
32    //
33    // This rule makes use of a beta feature and is subject to change without notice
34    // using the beta feature in custom rules is not suggested until it has been formally released
35    //
36    or beta.profile.by_reply_to().solicited == false
37  )  
38tags:
39  - "Attack surface reduction"
40attack_types:
41  - "Spam"
42tactics_and_techniques:
43  - "Social engineering"
44  - "Evasion"
45detection_methods:
46  - "Sender analysis"
47  - "Header analysis"
48  - "Whois"
49id: "a00900fd-1b91-568e-ab9b-bd33873af253"