sublimemediumRule

Service abuse: SurveyMonkey with suspicious outbound links

Detects messages sent from SurveyMonkey's user domain that contain links to non-SurveyMonkey domains within nested table elements, excluding survey-related content.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
and sender.email.domain.root_domain == "surveymonkeyuser.com"
and any(html.xpath(body.html, '//table//table//a').nodes,
        .links[0].href_url.domain.root_domain != "surveymonkey.com"
        and not strings.icontains(.inner_text, "survey")
        and not (
          .links[0].href_url.domain.root_domain in (
            "mimecast.com",
            "mimecastprotect.com"
          )
          and any(.links[0].href_url.query_params_decoded['domain'],
                  strings.parse_domain(.).domain in $tenant_domains
                  or strings.parse_domain(.).domain in ("surveymonkey.com", )
          )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Service abuse: SurveyMonkey with suspicious outbound links"
description: "Detects messages sent from SurveyMonkey's user domain that contain links to non-SurveyMonkey domains within nested table elements, excluding survey-related content."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and sender.email.domain.root_domain == "surveymonkeyuser.com"
  and any(html.xpath(body.html, '//table//table//a').nodes,
          .links[0].href_url.domain.root_domain != "surveymonkey.com"
          and not strings.icontains(.inner_text, "survey")
          and not (
            .links[0].href_url.domain.root_domain in (
              "mimecast.com",
              "mimecastprotect.com"
            )
            and any(.links[0].href_url.query_params_decoded['domain'],
                    strings.parse_domain(.).domain in $tenant_domains
                    or strings.parse_domain(.).domain in ("surveymonkey.com", )
            )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Impersonation: Brand"
detection_methods:
  - "Content analysis"
  - "HTML analysis"
  - "Sender analysis"
  - "URL analysis"
id: "f183bd14-d8f0-5a69-9cce-9a9eee855bf7"