sublimemediumRule

Link: Document-themed link to newly registered domain

Detects inbound emails containing links whose display text mimics a document file (.xlsx, .xls, .pdf, .doc, .docx) but whose resolved destination domain was registered within the last 30 days, a strong indicator of a newly stood-up malicious infrastructure used to harvest credentials or deliver malware.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1204.002 T1486 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and any(body.current_thread.links,
        strings.ends_with(.display_text,
                          '.xlsx',
                          '.xls',
                          '.pdf',
                          '.doc',
                          '.docx'
        )
        and network.whois(ml.link_analysis(., mode="aggressive").effective_url.domain
        ).days_old <= 30
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Document-themed link to newly registered domain"
description: "Detects inbound emails containing links whose display text mimics a document file (.xlsx, .xls, .pdf, .doc, .docx) but whose resolved destination domain was registered within the last 30 days, a strong indicator of a newly stood-up malicious infrastructure used to harvest credentials or deliver malware."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.current_thread.links,
          strings.ends_with(.display_text,
                            '.xlsx',
                            '.xls',
                            '.pdf',
                            '.doc',
                            '.docx'
          )
          and network.whois(ml.link_analysis(., mode="aggressive").effective_url.domain
          ).days_old <= 30
  )
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "URL analysis"
  - "Whois"
  - "Content analysis"
id: "32e634b4-abfa-51b9-ab13-a58c05a3071e"