sublimemediumRule

Link: Suspicious single-domain link with suspicious path and financial lure indicators

Detects inbound messages containing a single unique root domain across all links, where at least one link follows a suspicious path pattern. Additionally, the message body contains HTML elements consistent with financial lure tactics, such as 'cash offer', 'confirm info', or 'view rates' styled with specific background colors indicative of a structured deceptive template.

MITRE ATT&CK

T1566 T1598

initial-access

Detection Query

type.inbound
and length(distinct(body.current_thread.links, .href_url.domain.root_domain)) == 1
and any(body.current_thread.links,
        regex.contains(.href_url.path, '\/[a-z]\/[a-z0-9]{32}')
        and length(.href_url.domain.subdomain) == 3
)
and (
  any(html.xpath(body.html, '//a').nodes,
      (
        strings.icontains(.raw, "color:#4fb077")
        and strings.icontains(.display_text, 'cash offer')
      )
  )
  or (
    any(body.current_thread.links,
        strings.icontains(.display_text, 'confirm info', 'view rates')
    )
    and strings.icontains(body.html.raw, 'background-color: #007bc2')
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Suspicious single-domain link with suspicious path and financial lure indicators"
description: "Detects inbound messages containing a single unique root domain across all links, where at least one link follows a suspicious path pattern. Additionally, the message body contains HTML elements consistent with financial lure tactics, such as 'cash offer', 'confirm info', or 'view rates' styled with specific background colors indicative of a structured deceptive template."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and length(distinct(body.current_thread.links, .href_url.domain.root_domain)) == 1
  and any(body.current_thread.links,
          regex.contains(.href_url.path, '\/[a-z]\/[a-z0-9]{32}')
          and length(.href_url.domain.subdomain) == 3
  )
  and (
    any(html.xpath(body.html, '//a').nodes,
        (
          strings.icontains(.raw, "color:#4fb077")
          and strings.icontains(.display_text, 'cash offer')
        )
    )
    or (
      any(body.current_thread.links,
          strings.icontains(.display_text, 'confirm info', 'view rates')
      )
      and strings.icontains(body.html.raw, 'background-color: #007bc2')
    )
  )
attack_types:
  - "Spam"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "HTML analysis"
  - "URL analysis"
id: "67a2606a-8577-551f-8f42-c3040937633d"