sublimelowRule

Link: Display text is 'unsb'

Flags inbound emails containing a link where the visible display text is the abbreviated term 'unsb'.

MITRE ATT&CK

initial-access

Detection Query

type.inbound
and any(body.current_thread.links, .display_text == "unsb")

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Link: Display text is 'unsb'"
description: "Flags inbound emails containing a link where the visible display text is the abbreviated term 'unsb'."
type: "rule"
severity: "low"
source: |
  type.inbound
  and any(body.current_thread.links, .display_text == "unsb")
tags:
  - "Attack surface reduction"
attack_types:
  - "Spam"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "4f13f12b-bc96-5973-8967-698ddb2732ba"