Spam: VertiStream warm-up article excerpt

 1name: "Spam: VertiStream warm-up article excerpt"
 2description: "Detects VertiStream warm-up messages: a single unpunctuated line from a scraped article, cut off with an ellipsis."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(filter(body.current_thread.links, .href_url.scheme != "mailto")) == 0
 8  and length(attachments) == 0
 9  and not subject.is_reply
10  and not subject.is_forward
11  // one line, no punctuation, cut off mid-word with "..." or "…"
12  // the excerpt is cut at about 160 to 200 characters and is ascii apart from the "…"
13  and strings.count(body.current_thread.text, "\n") == 0
14  and length(body.current_thread.text) >= 140
15  and length(body.current_thread.text) <= 210
16  and regex.imatch(body.current_thread.text,
17                   '[^[:punct:]\p{P}]+[a-z](?:\.\.\.|…)\s*'
18  )
19  and not regex.icontains(body.current_thread.text, '[^\x00-\x7F…]')
20  // multi-word title with no punctuation; skip up to 3 leading separator characters
21  // that subject.base leaves behind gateway tags ("- ", "_", ": ")
22  and length(subject.base) >= 10
23  and regex.icontains(subject.base, '\w\s+\w')
24  and regex.imatch(subject.base, '[\s[:punct:]\p{P}]{0,3}[^[:punct:]\p{P}]+')  
25attack_types:
26  - "Spam"
27tactics_and_techniques:
28  - "Social engineering"
29detection_methods:
30  - "Content analysis"
31id: "8a827b54-01a1-5723-9b30-40a37a6a66f3"