Spam: VertiStream marketing tracking links

 1name: "Spam: VertiStream marketing tracking links"
 2description: "Detects VertiStream B2B content-syndication lead-gen messages by their tracking links: sponsor-branded content offers with no attachments, sent from bulk-registered, tech-themed compound domains, linking to a numeric tracking path on the sender's own domain with either uid, prom_type and prom_id parameters, or the newer c and s UUID parameters."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(attachments) == 0
 8  // VertiStream's tracking-link format on the sender's own domain
 9  and any(body.current_thread.links,
10          .href_url.domain.root_domain == sender.email.domain.root_domain
11          and regex.imatch(.href_url.path, '/[0-9]+-[0-9]+/[0-9]+')
12          and (
13            // ?uid=&prom_type=&prom_id=
14            all(["uid", "prom_type", "prom_id"],
15                . in keys(..href_url.query_params_decoded)
16            )
17            // ?c=<uuid>&s=<uuid>
18            or (
19              any(.href_url.query_params_decoded["c"],
20                  regex.imatch(.,
21                               '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
22                  )
23              )
24              and any(.href_url.query_params_decoded["s"],
25                      regex.imatch(.,
26                                   '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
27                      )
28              )
29            )
30          )
31  )  
32attack_types:
33  - "Spam"
34tactics_and_techniques:
35  - "Social engineering"
36detection_methods:
37  - "URL analysis"
38  - "Sender analysis"
39id: "90680852-5b35-58ec-991a-a38dd5a5e8b0"