sublimelowRule

Link: Romance/Sexual Language With Suspicious Link

Detects messages containing romantic or adult-themed language, combined with links to newly registered domains or suspicious reply-to addresses.

MITRE ATT&CK

T1566 T1598

initial-access

Detection Query

type.inbound
and length(body.previous_threads) == 0
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in ("Romance", "Sexually Explicit Messages")
        and .confidence == "high"
)
and 1 of (
  any(body.links, network.whois(.href_url.domain).days_old < 30),
  any(body.links, .href_url.domain.root_domain in $url_shorteners),
  any(headers.reply_to, network.whois(.email.domain).days_old < 30)
)
and 0 < length(distinct(body.links,
                        .href_url.domain.root_domain not in ("aka.ms")
               )
) < 3
and all(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Romance/Sexual Language With Suspicious Link"
description: "Detects messages containing romantic or adult-themed language, combined with links to newly registered domains or suspicious reply-to addresses."
type: "rule"
severity: "low"
source: |
  type.inbound
  and length(body.previous_threads) == 0
  and any(ml.nlu_classifier(body.current_thread.text).topics,
          .name in ("Romance", "Sexually Explicit Messages")
          and .confidence == "high"
  )
  and 1 of (
    any(body.links, network.whois(.href_url.domain).days_old < 30),
    any(body.links, .href_url.domain.root_domain in $url_shorteners),
    any(headers.reply_to, network.whois(.email.domain).days_old < 30)
  )
  and 0 < length(distinct(body.links,
                          .href_url.domain.root_domain not in ("aka.ms")
                 )
  ) < 3
  and all(body.links,
          .href_url.domain.root_domain != sender.email.domain.root_domain
  )

attack_types:
  - "Spam"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "URL analysis"
  - "Whois"
id: "d5694cae-bee8-588e-8123-2c3e3459118b"