sublimemediumRule

Link: Free file host link with 'Important Viewing Note' lure

Detects inbound messages containing links to free file hosting domains paired with the phrase 'important viewing note' in the message body. These messages often masquerade as institutional or educational communications — such as student conduct reports or advancement initiatives — to add legitimacy and encourage recipients to follow the hosted link.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
and any(body.current_thread.links, .href_url.domain.domain in $free_file_hosts)
and strings.icontains(body.current_thread.text, 'important viewing note')

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Free file host link with 'Important Viewing Note' lure"
description: "Detects inbound messages containing links to free file hosting domains paired with the phrase 'important viewing note' in the message body. These messages often masquerade as institutional or educational communications — such as student conduct reports or advancement initiatives — to add legitimacy and encourage recipients to follow the hosted link."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.current_thread.links, .href_url.domain.domain in $free_file_hosts)
  and strings.icontains(body.current_thread.text, 'important viewing note')
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Free file host"
  - "Social engineering"
  - "Impersonation: Brand"
detection_methods:
  - "Content analysis"
  - "URL analysis"
  - "Threat intelligence"
id: "6b5e1f55-1143-533d-8342-726373dc7f10"