Skip to content

Create self_sender_cred_theft_short_path_link.yml #4378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
D-Bolton wants to merge 4 commits into
base: main
Choose a base branch
from
+33 −0
Open

Create self_sender_cred_theft_short_path_link.yml #4378

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4c9455d
Create self_sender_cred_theft_short_path_link.yml
D-Bolton Apr 21, 2026
022a884
Auto-format MQL and add rule IDs
Apr 21, 2026
59f582f
Update detection-rules/self_sender_cred_theft_short_path_link.yml
D-Bolton Apr 23, 2026
5cdf4cc
update name and description
D-Bolton Apr 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions detection-rules/self_sender_cred_theft_short_path_link.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: "Link: Single character path with credential theft body and self sender behavior or invalid recipient"
description: "Message where the sender and recipient are the same or the recipient domain is invalid, contains a link with a single character path and no query parameters or fragments, and includes credential theft language."
type: "rule"
severity: "medium"
source: |
type.inbound
// self sender or invaild recipent domain
and length(recipients.to) == 1
and (
sender.email.email == recipients.to[0].email.email
or recipients.to[0].email.domain.valid == false
Copy link
Copy Markdown
Member

@zoomequipd zoomequipd Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this "or" statement scope the message beyond self-sender? behvaior?

Copy link
Copy Markdown
Member Author

@D-Bolton D-Bolton Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated the name and description to account for this logic. Let me know what you think.

)
// path contains 1 character
and any(body.current_thread.links,
regex.imatch(.href_url.path, '\/[A-Za-z0-9]')
and .href_url.query_params is null
and .href_url.fragment is null
and .display_url.url is null
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence != "low"
)
attack_types:
- "Credential Phishing"
tactics_and_techniques:
- "Evasion"
- "Social engineering"
detection_methods:
- "Natural Language Understanding"
- "URL analysis"
- "Sender analysis"
- "Header analysis"
id: "c97982e6-eaa2-53e3-ba8f-0dc4db55b936"
Loading