Spam: URL shortener with short body content and emojis

 1name: "Spam: URL shortener with short body content and emojis"
 2description: |
 3    Detects spam from freemail senders, where the majority of the body is a URL shortener and emojis.
 4type: "rule"
 5severity: "low"
 6source: |
 7  type.inbound
 8
 9  // sender is a freemail
10  and sender.email.domain.root_domain in $free_email_providers
11
12  // has a URL shortener
13  and any(body.links, .href_url.domain.root_domain in $url_shorteners)
14
15  // short body, basically just the URL
16  and length(body.plain.raw) < 100
17
18  // has an emoji in the subject or body
19  and (
20    regex.contains(body.plain.raw,
21                   '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
22    )
23    or regex.contains(subject.subject,
24                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
25    )
26  )
27
28  // first-time sender
29  and (
30    (
31      sender.email.domain.root_domain in $free_email_providers
32      and sender.email.email not in $sender_emails
33    )
34    or (
35      sender.email.domain.root_domain not in $free_email_providers
36      and sender.email.domain.domain not in $sender_domains
37    )
38  )  
39attack_types:
40  - "Spam"
41tactics_and_techniques:
42  - "Free email provider"
43detection_methods:
44  - "Content analysis"
45  - "Sender analysis"
46  - "URL analysis"
47id: "b7797e4c-f2d7-5330-8a16-7123fe9bb6a8"