sublimemediumRule

Service abuse: Linode Objects HTML file hosting

Detects inbound messages containing links to HTML files hosted on Linode's object storage service (linodeobjects.com). This pattern is commonly used to host malicious content or bypass security controls by leveraging legitimate cloud storage infrastructure.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1204.002 T1486 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(body.current_thread.links,
        .href_url.domain.root_domain == "linodeobjects.com"
        and strings.iends_with(.href_url.path, ".html")
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Service abuse: Linode Objects HTML file hosting"
description: "Detects inbound messages containing links to HTML files hosted on Linode's object storage service (linodeobjects.com). This pattern is commonly used to host malicious content or bypass security controls by leveraging legitimate cloud storage infrastructure."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.current_thread.links,
          .href_url.domain.root_domain == "linodeobjects.com"
          and strings.iends_with(.href_url.path, ".html")
  )
tags:
 - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Free file host"
  - "Evasion"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "7e223bac-b437-57e5-be99-f82b23c4ca61"