sublimemediumRule

Spam: Link to blob.core.windows.net from new domain (<30d)

This rule detects messages containing a link to blob.core.windows.net from a sender domain less than 30 days old. There is a single recipient present, but the recipient is a random email address, and not someone at the organization.

MITRE ATT&CK

T1566

Detection Query

type.inbound
and length(recipients.to) == 1
and any(recipients.to, .email.domain.root_domain not in $org_domains)
and network.whois(sender.email.domain).days_old < 30
and length(body.links) < 3
and any(body.links,
        strings.ends_with(.href_url.domain.subdomain, "blob.core")
        and .href_url.domain.root_domain == "windows.net"
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Spam: Link to blob.core.windows.net from new domain (<30d)"
description: "This rule detects messages containing a link to blob.core.windows.net from a sender domain less than 30 days old. There is a single recipient present, but the recipient is a random email address, and not someone at the organization."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and length(recipients.to) == 1
  and any(recipients.to, .email.domain.root_domain not in $org_domains)
  and network.whois(sender.email.domain).days_old < 30
  and length(body.links) < 3
  and any(body.links,
          strings.ends_with(.href_url.domain.subdomain, "blob.core")
          and .href_url.domain.root_domain == "windows.net"
  )
  and (
    not profile.by_sender().solicited
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
  and not profile.by_sender().any_messages_benign

attack_types:
  - "Spam"
tactics_and_techniques:
  - "Free subdomain host"
detection_methods:
  - "Header analysis"
  - "URL analysis"
  - "Sender analysis"
id: "a09b3800-50b6-5ea9-b96e-367b6c8b5125"