Create link_trac_link_jwt_encoded.yml

detection-rules/link_trac_link_jwt_encoded.yml

@@ -0,0 +1,42 @@
+name: "Link: Trac-link URL with JWT encoding"
+description: "Detects messages containing links to trac-link.com, in either the body or PDF attachments, with JWT encoded url paths."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and (
+    // body links
+    any(body.links,
+        .href_url.domain.root_domain == "trac-link.com"
+        // JWT encoding present x.x.x
+        and regex.icontains(.href_url.path,
+                            '[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]'
+        )
+    )
+
+    // attachment links
+    or any(attachments,
+           (.file_extension == "pdf" or .file_type == "pdf")
+           and any(file.explode(.),
+                   any(.scan.pdf.urls,
+                       .domain.root_domain == "trac-link.com"
+                       // JWT encoding present x.x.x
+                       and regex.icontains(.path,
+                                           '[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]'
+                       )
+                   )
+           )
+    )
+  )
+
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Open redirect"
+  - "Evasion"
+  - "PDF"
+detection_methods:
+  - "URL analysis"
+  - "File analysis"
+  - "Content analysis"
+id: "b00f3aa4-aae4-5353-a8a4-508a580cd1aa"