sublimemediumRule

Link: Mismatched free file host links with document lure

Detects inbound emails containing mismatched hyperlinks where the displayed URL references a free file hosting service but the actual destination points to another free file host or a suspicious TLD. The rule combines this with NLU classification identifying BEC or credential theft intent, along with body text patterns common to fake document/scan notifications (e.g., 'scanned from', 'shared via', 'for your review') or short, urgency-driven messages. Trusted senders with passing DMARC are excluded to reduce false positives.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1566.001 T1598

initial-access

Detection Query

type.inbound
and any(filter(body.current_thread.links, .mismatched),
        any([.display_url.domain.domain, .display_url.domain.root_domain],
            . in $free_file_hosts
        )
        and (
          any([.href_url.domain.domain, .href_url.domain.root_domain],
              . in $free_file_hosts
          )
          or .href_url.domain.tld in $suspicious_tlds
        )
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("bec", "cred_theft") and .confidence != "low"
)
and 2 of (
  regex.icontains(body.current_thread.text,
                  'scanned from',
                  'total images',
                  'attachment format',
                  'scan information',
                  'statement/remittance',
                  'versalink',
                  'made a file available',
                  'document from .{0,40}is available',
                  '(?:uploaded|shared) via',
                  '(?:report|available) for your review'
  ),
  regex.icontains(body.current_thread.text, '={5,}|_{10,}'),
  length(body.current_thread.text) < 700,
  regex.icontains(body.current_thread.text,
                  'kindly review',
                  'review the attached',
                  'let us know the next step',
                  'for your review',
                  'please review the'
  )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Mismatched free file host links with document lure"
description: "Detects inbound emails containing mismatched hyperlinks where the displayed URL references a free file hosting service but the actual destination points to another free file host or a suspicious TLD. The rule combines this with NLU classification identifying BEC or credential theft intent, along with body text patterns common to fake document/scan notifications (e.g., 'scanned from', 'shared via', 'for your review') or short, urgency-driven messages. Trusted senders with passing DMARC are excluded to reduce false positives."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(filter(body.current_thread.links, .mismatched),
          any([.display_url.domain.domain, .display_url.domain.root_domain],
              . in $free_file_hosts
          )
          and (
            any([.href_url.domain.domain, .href_url.domain.root_domain],
                . in $free_file_hosts
            )
            or .href_url.domain.tld in $suspicious_tlds
          )
  )
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name in ("bec", "cred_theft") and .confidence != "low"
  )
  and 2 of (
    regex.icontains(body.current_thread.text,
                    'scanned from',
                    'total images',
                    'attachment format',
                    'scan information',
                    'statement/remittance',
                    'versalink',
                    'made a file available',
                    'document from .{0,40}is available',
                    '(?:uploaded|shared) via',
                    '(?:report|available) for your review'
    ),
    regex.icontains(body.current_thread.text, '={5,}|_{10,}'),
    length(body.current_thread.text) < 700,
    regex.icontains(body.current_thread.text,
                    'kindly review',
                    'review the attached',
                    'let us know the next step',
                    'for your review',
                    'please review the'
    )
  )
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
tactics_and_techniques:
  - "Free file host"
  - "Social engineering"
detection_methods:
  - "Natural Language Understanding"
  - "URL analysis"
  - "Content analysis"
id: "19836dcf-cde4-5d9a-903f-c74c1e88e33d"