Spam: New link domain (<=10d) and emojis

 1name: "Spam: New link domain (<=10d) and emojis"
 2description: |
 3    Detects spam from freemail senders, where the linked domain is less than 10 days old and emojis present.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8
 9  // sender is a freemail
10  and sender.email.domain.root_domain in $free_email_providers
11
12  // linked domain is less than 10 days old
13  and any(body.links, beta.whois(.href_url.domain).days_old < 10)
14
15  // has an emoji in the subject or body
16  and (
17    regex.contains(body.plain.raw,
18                   '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
19    )
20    or regex.contains(subject.subject,
21                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
22    )
23  )
24
25  // first-time sender
26  and (
27    (
28      sender.email.domain.root_domain in $free_email_providers
29      and sender.email.email not in $sender_emails
30    )
31    or (
32      sender.email.domain.root_domain not in $free_email_providers
33      and sender.email.domain.domain not in $sender_domains
34    )
35  )  
36attack_types:
37  - "Spam"
38tactics_and_techniques:
39  - "Free email provider"
40detection_methods:
41  - "Content analysis"
42  - "Sender analysis"
43  - "URL analysis"
44  - "Whois"
45id: "33677993-9c21-54e6-8633-e03b2063e332"