Spam: SenderTeam marketing tracking links

 1name: "Spam: SenderTeam marketing tracking links"
 2description: "Detects B2B content-syndication lead-gen messages from SenderTeam, VertiStream's sister sending identity, by their tracking links: sponsor-branded content offers and surveys with no attachments, linking to /tr/click, /tr/unsubscribe or a hidden /tr/bclick on the sender's own domain with a base58 uid, a numeric sid and a type parameter."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(attachments) == 0
 8  // SenderTeam's tracking-link format on the sender's own domain
 9  // /tr/click?uid=<base58>&type=c&sid=<n>
10  and any(body.current_thread.links,
11          .href_url.domain.root_domain == sender.email.domain.root_domain
12          and regex.imatch(.href_url.path, '/tr/(?:click|unsubscribe|bclick)')
13          and any(.href_url.query_params_decoded["uid"],
14                  regex.match(., '[1-9A-HJ-NP-Za-km-z]+')
15          )
16          and any(.href_url.query_params_decoded["sid"],
17                  regex.imatch(., '[0-9]+')
18          )
19          and any(.href_url.query_params_decoded["type"], . in ("c", "u", "b"))
20  )  
21attack_types:
22  - "Spam"
23tactics_and_techniques:
24  - "Social engineering"
25detection_methods:
26  - "URL analysis"
27  - "Sender analysis"
28id: "e6202ccd-9a5f-5ec2-9501-796066ee9af9"