Spam: Campaign with excessive display-text and keywords found
Detects affiliate marketing spam where any link contains display-text greater than 3000 chars and specific values found.
Sublime rule (View on GitHub)
1name: "Spam: Campaign with excessive display-text and keywords found"
2description: |
3 Detects affiliate marketing spam where any link contains display-text greater than 3000 chars and specific values found.
4references:
5 - "https://playground.sublimesecurity.com?id=aa90e106-fa06-43f2-aa85-50d69591e073"
6type: "rule"
7severity: "low"
8source: |
9 type.inbound
10 and length(body.links) > 0
11 and any(body.links, length(.display_text) > 3000)
12 and any(body.links, regex.icontains(.display_text, '(\bPassword:)', 'Hi.{0,5}Welcome\b'))
13 and (
14 profile.by_sender().prevalence in ("new", "outlier")
15 or (
16 profile.by_sender().any_messages_malicious_or_spam
17 and not profile.by_sender().any_false_positives
18 )
19 )
20attack_types:
21 - "Spam"
22detection_methods:
23 - "Content analysis"
24id: "140e46a1-c8a6-530a-ad88-21b7e4b4b02f"