sublimemediumRule

Link: Fake video link from newly registered domain

Detects inbound messages from a sender using the local part 'support' whose domain was registered less than 30 days ago, containing a link with a path resembling a video file URL structure ('.mp4/views/').

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1566 T1598

initial-access

Detection Query

type.inbound
and sender.email.local_part == "support"
and network.whois(sender.email.domain).days_old < 30
and any(body.current_thread.links,
        strings.contains(.href_url.path, ".mp4/views/")
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Fake video link from newly registered domain"
description: "Detects inbound messages from a sender using the local part 'support' whose domain was registered less than 30 days ago, containing a link with a path resembling a video file URL structure ('.mp4/views/')."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and sender.email.local_part == "support"
  and network.whois(sender.email.domain).days_old < 30
  and any(body.current_thread.links,
          strings.contains(.href_url.path, ".mp4/views/")
  )
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Whois"
  - "URL analysis"
  - "Sender analysis"
id: "dc1f5d72-233b-5c20-8573-bdebf23552ce"