Spam: New link domain (<=10d) and emojis

 1name: "Spam: New link domain (<=10d) and emojis"
 2description: |
 3    Detects spam from freemail senders, where the linked domain is less than 10 days old and emojis present.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8
 9  // sender is a freemail
10  and sender.email.domain.root_domain in $free_email_providers
11
12  // linked domain is less than 10 days old
13  and any(body.links, network.whois(.href_url.domain).days_old < 10)
14
15  // has an emoji in the subject or body
16  and (
17    regex.contains(body.plain.raw,
18                   '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
19    )
20    or regex.contains(subject.subject,
21                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
22    )
23  )
24  and (
25    profile.by_sender().prevalence in ("new", "outlier")
26    or (
27      profile.by_sender().any_messages_malicious_or_spam
28      and not profile.by_sender().any_false_positives
29    )
30  )  
31attack_types:
32  - "Spam"
33tactics_and_techniques:
34  - "Free email provider"
35detection_methods:
36  - "Content analysis"
37  - "Sender analysis"
38  - "URL analysis"
39  - "Whois"
40id: "33677993-9c21-54e6-8633-e03b2063e332"