sublimemediumRule

Service abuse: Outlook Groups with Google Sites link and evasion tag

Detects inbound messages sent via Outlook Groups (groups.outlook.com) that contain links to Google Sites, combined with a suspicious short alphanumeric tag appended to either the message body or subject line. This pattern is commonly used to evade detection while redirecting recipients to credential harvesting pages hosted on Google Sites.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and headers.return_path.domain.domain == "groups.outlook.com"
and any(body.current_thread.links,
        .href_url.domain.domain == "sites.google.com"
)
and (
  regex.icontains(body.current_thread.text, '\n[a-z0-9]{3}\s*$')
  or regex.icontains(subject.base, '\s{2,}[a-z0-9]{3}\s*$')
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Service abuse: Outlook Groups with Google Sites link and evasion tag"
description: "Detects inbound messages sent via Outlook Groups (groups.outlook.com) that contain links to Google Sites, combined with a suspicious short alphanumeric tag appended to either the message body or subject line. This pattern is commonly used to evade detection while redirecting recipients to credential harvesting pages hosted on Google Sites."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and headers.return_path.domain.domain == "groups.outlook.com"
  and any(body.current_thread.links,
          .href_url.domain.domain == "sites.google.com"
  )
  and (
    regex.icontains(body.current_thread.text, '\n[a-z0-9]{3}\s*$')
    or regex.icontains(subject.base, '\s{2,}[a-z0-9]{3}\s*$')
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Free subdomain host"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "URL analysis"
  - "Sender analysis"
id: "c4a6c6bf-2d07-550e-8d67-8d8c6658b1a1"