Spam: URL shortener with short body content and emojis

 1name: "Spam: URL shortener with short body content and emojis"
 2description: |
 3    Detects spam from freemail senders, where the majority of the body is a URL shortener and emojis.
 4type: "rule"
 5severity: "low"
 6source: |
 7  type.inbound
 8  
 9  // sender is a freemail
10  and sender.email.domain.root_domain in $free_email_providers
11  
12  // has a URL shortener
13  and any(body.links,
14          .href_url.domain.root_domain in $url_shorteners
15          or .href_url.domain.root_domain in $social_landing_hosts
16  )
17  
18  // short body, basically just the URL
19  and length(body.plain.raw) < 100
20  
21  // has an emoji in the subject or body
22  and (
23    regex.contains(body.plain.raw,
24                   '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
25    )
26    or regex.contains(subject.subject,
27                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
28    )
29  )
30  and (
31    profile.by_sender().prevalence in ("new", "outlier")
32    or (
33      profile.by_sender().any_messages_malicious_or_spam
34      and not profile.by_sender().any_messages_benign
35    )
36  )  
37attack_types:
38  - "Spam"
39tactics_and_techniques:
40  - "Free email provider"
41detection_methods:
42  - "Content analysis"
43  - "Sender analysis"
44  - "URL analysis"
45id: "b7797e4c-f2d7-5330-8a16-7123fe9bb6a8"