Spam: URL shortener with short body content and emojis

 1name: "Spam: URL shortener with short body content and emojis"
 2description: |
 3    Detects spam from freemail senders, where the majority of the body is a URL shortener and emojis.
 4type: "rule"
 5severity: "low"
 6source: |
 7  type.inbound
 8
 9  // sender is a freemail
10  and sender.email.domain.root_domain in $free_email_providers
11
12  // has a URL shortener
13  and any(body.links, .href_url.domain.root_domain in $url_shorteners)
14
15  // short body, basically just the URL
16  and length(body.plain.raw) < 100
17
18  // has an emoji in the subject or body
19  and (
20    regex.contains(body.plain.raw,
21                   '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
22    )
23    or regex.contains(subject.subject,
24                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
25    )
26  )
27  and (
28    profile.by_sender().prevalence in ("new", "outlier")
29    or (
30      profile.by_sender().any_messages_malicious_or_spam
31      and not profile.by_sender().any_false_positives
32    )
33  )  
34attack_types:
35  - "Spam"
36tactics_and_techniques:
37  - "Free email provider"
38detection_methods:
39  - "Content analysis"
40  - "Sender analysis"
41  - "URL analysis"
42id: "b7797e4c-f2d7-5330-8a16-7123fe9bb6a8"