sublimemediumRule

Link: Free subdomain host with undisclosed recipients

Detects messages with undisclosed recipients, containing links to free subdomain hosts

Detection Query

type.inbound
and any(body.links,
        .href_url.domain.root_domain in $free_subdomain_hosts
        and .href_url.domain.subdomain is not null
        and .href_url.domain.subdomain != "www"
        and not (
          .href_url.domain.root_domain == "googleusercontent.com"
          and strings.istarts_with(.href_url.path, "/mail-sig")
        )
)
and (
  length(recipients.to) == 0
  or all(recipients.to, .display_name == "Undisclosed recipients")
)
and length(recipients.cc) == 0
and length(recipients.bcc) == 0

// negate listmailers & benign threads
and not (
  any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name == "benign" and .confidence == "high"
  )
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Link: Free subdomain host with undisclosed recipients"
description: |
  Detects messages with undisclosed recipients, containing links to free subdomain hosts
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.links,
          .href_url.domain.root_domain in $free_subdomain_hosts
          and .href_url.domain.subdomain is not null
          and .href_url.domain.subdomain != "www"
          and not (
            .href_url.domain.root_domain == "googleusercontent.com"
            and strings.istarts_with(.href_url.path, "/mail-sig")
          )
  )
  and (
    length(recipients.to) == 0
    or all(recipients.to, .display_name == "Undisclosed recipients")
  )
  and length(recipients.cc) == 0
  and length(recipients.bcc) == 0
  
  // negate listmailers & benign threads
  and not (
    any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
    or any(ml.nlu_classifier(body.current_thread.text).intents,
           .name == "benign" and .confidence == "high"
    )
  )
  and (
    profile.by_sender().prevalence in ("new", "outlier")
    or profile.by_sender().any_messages_malicious_or_spam
  )
  and not profile.by_sender().any_messages_benign
tags:
  - "Attack surface reduction"
tactics_and_techniques:
  - "Free subdomain host"
detection_methods:
  - "Header analysis"
  - "URL analysis"
id: "c23d979d-de80-599d-b0ca-c7fef217885e"