sublimelowRule

Spam: Campaign with excessive display-text and keywords found

Detects affiliate marketing spam where any link contains display-text greater than 3000 chars and specific values found.

MITRE ATT&CK

T1566

Detection Query

type.inbound
and length(body.links) > 0
and any(body.links, length(.display_text) > 3000)
and any(body.links,
        regex.icontains(.display_text, '(\bPassword:)', 'Hi.{0,5}Welcome\b')
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

https://playground.sublimesecurity.com?id=aa90e106-fa06-43f2-aa85-50d69591e073

Raw Content

name: "Spam: Campaign with excessive display-text and keywords found"
description: |
  Detects affiliate marketing spam where any link contains display-text greater than 3000 chars and specific values found. 
references:
  - "https://playground.sublimesecurity.com?id=aa90e106-fa06-43f2-aa85-50d69591e073"
type: "rule"
severity: "low"
source: |
  type.inbound
  and length(body.links) > 0
  and any(body.links, length(.display_text) > 3000)
  and any(body.links,
          regex.icontains(.display_text, '(\bPassword:)', 'Hi.{0,5}Welcome\b')
  )
  and (
    profile.by_sender().prevalence in ("new", "outlier")
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
attack_types:
  - "Spam"
detection_methods:
  - "Content analysis"
id: "140e46a1-c8a6-530a-ad88-21b7e4b4b02f"