Spam: Campaign with excessive display-text and keywords found

calendar Aug 21, 2023  ยท
Share on: linkedin copy

Detects affiliate marketing spam where any link contains display-text greater than 3000 chars and specific values found.

Sublime rule (View on GitHub)

 1name: "Spam: Campaign with excessive display-text and keywords found"
 2description: |
 3    Detects affiliate marketing spam where any link contains display-text greater than 3000 chars and specific values found. 
 4references:
 5  - "https://playground.sublimesecurity.com?id=aa90e106-fa06-43f2-aa85-50d69591e073"
 6type: "rule"
 7severity: "low"
 8source: |
 9  type.inbound
10  and length(body.links) > 0
11  and any(body.links, length(.display_text) > 3000)
12  and any(body.links, regex.icontains(.display_text, '(\bPassword:)', 'Hi.{0,5}Welcome\b'))
13  // first-time sender
14  and (
15    (
16      sender.email.domain.root_domain in $free_email_providers
17      and sender.email.email not in $sender_emails
18    )
19    or (
20      sender.email.domain.root_domain not in $free_email_providers
21      and sender.email.domain.domain not in $sender_domains
22    )
23  )  
24attack_types:
25  - "Spam"
26detection_methods:
27  - "Content analysis"
28id: "140e46a1-c8a6-530a-ad88-21b7e4b4b02f"
to-top