From 23f9892d59405d1789fddf1039b1d55d53016f29 Mon Sep 17 00:00:00 2001 From: "Brandon 2: Brandon Harder" <189403278+missingn0pe@users.noreply.github.com> Date: Tue, 8 Sep 2026 19:39:07 -0500 Subject: [PATCH 1/3] Create link_trac_link_jwt_encoded.yml Detects messages containing links to trac-link.com, in either the body or PDF attachments, with JWT encoded url paths. --- .../link_trac_link_jwt_encoded.yml | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 detection-rules/link_trac_link_jwt_encoded.yml diff --git a/detection-rules/link_trac_link_jwt_encoded.yml b/detection-rules/link_trac_link_jwt_encoded.yml new file mode 100644 index 00000000000..e5188c50818 --- /dev/null +++ b/detection-rules/link_trac_link_jwt_encoded.yml @@ -0,0 +1,41 @@ +name: "Link: Trac-link URL with JWT encoding" +description: "Detects messages containing links to trac-link.com, in either the body or PDF attachments, with JWT encoded url paths." +type: "rule" +severity: "medium" +source: | + type.inbound + and ( + // body links + any(body.links, + .href_url.domain.root_domain == "trac-link.com" + // JWT encoding present x.x.x + and regex.icontains(.href_url.path, + '[A-Za-z0-9_-].[A-Za-z0-9_-].[A-Za-z0-9_-]' + ) + ) + + // attachment links + or any(attachments, + (.file_extension == "pdf" or .file_type == "pdf") + and any(file.explode(.), + any(.scan.pdf.urls, + .domain.root_domain == "trac-link.com" + // JWT encoding present x.x.x + and regex.icontains(.path, + '[A-Za-z0-9_-].[A-Za-z0-9_-].[A-Za-z0-9_-]' + ) + ) + ) + ) + ) + +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Open redirect" + - "Evasion" + - "PDF" +detection_methods: + - "URL analysis" + - "File analysis" + - "Content analysis" From 8a1c9f116d134cf3272637651f0582542663eff5 Mon Sep 17 00:00:00 2001 From: CI Bot Date: Wed, 9 Sep 2026 00:42:22 +0000 Subject: [PATCH 2/3] Auto-format MQL and add rule IDs --- detection-rules/link_trac_link_jwt_encoded.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/link_trac_link_jwt_encoded.yml b/detection-rules/link_trac_link_jwt_encoded.yml index e5188c50818..2af57ef6ce4 100644 --- a/detection-rules/link_trac_link_jwt_encoded.yml +++ b/detection-rules/link_trac_link_jwt_encoded.yml @@ -39,3 +39,4 @@ detection_methods: - "URL analysis" - "File analysis" - "Content analysis" +id: "b00f3aa4-aae4-5353-a8a4-508a580cd1aa" From 7585c514676963539ae195d24cb98e91df81ee92 Mon Sep 17 00:00:00 2001 From: "Brandon 2: Brandon Harder" <189403278+missingn0pe@users.noreply.github.com> Date: Tue, 8 Sep 2026 20:02:56 -0500 Subject: [PATCH 3/3] Update link_trac_link_jwt_encoded.yml Adding minimum count definers. --- detection-rules/link_trac_link_jwt_encoded.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detection-rules/link_trac_link_jwt_encoded.yml b/detection-rules/link_trac_link_jwt_encoded.yml index 2af57ef6ce4..8792017d2fa 100644 --- a/detection-rules/link_trac_link_jwt_encoded.yml +++ b/detection-rules/link_trac_link_jwt_encoded.yml @@ -10,7 +10,7 @@ source: | .href_url.domain.root_domain == "trac-link.com" // JWT encoding present x.x.x and regex.icontains(.href_url.path, - '[A-Za-z0-9_-].[A-Za-z0-9_-].[A-Za-z0-9_-]' + '[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]' ) ) @@ -22,7 +22,7 @@ source: | .domain.root_domain == "trac-link.com" // JWT encoding present x.x.x and regex.icontains(.path, - '[A-Za-z0-9_-].[A-Za-z0-9_-].[A-Za-z0-9_-]' + '[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]' ) ) )