From 4956810f8f51743426b2e88ee734425362961e98 Mon Sep 17 00:00:00 2001 From: Daniel Bolton Date: Wed, 9 Sep 2026 10:17:11 -0500 Subject: [PATCH 1/4] Create service_abuse_self_service_platform_new_domain.yml --- ...abuse_self_service_platform_new_domain.yml | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 detection-rules/service_abuse_self_service_platform_new_domain.yml diff --git a/detection-rules/service_abuse_self_service_platform_new_domain.yml b/detection-rules/service_abuse_self_service_platform_new_domain.yml new file mode 100644 index 00000000000..6e93d62d80a --- /dev/null +++ b/detection-rules/service_abuse_self_service_platform_new_domain.yml @@ -0,0 +1,22 @@ +name: "Service abuse: Self-service platform redirecting to newly registered suspicious domain" +description: "Detects inbound emails containing links to self-service creation platforms that ultimately redirect to newly registered domains (less than 30 days old) using suspicious top-level domains, indicating potential abuse of legitimate services to mask malicious redirect chains." +type: "rule" +severity: "medium" +source: | + type.inbound + and any(body.current_thread.links, + .href_url.domain.root_domain in $self_service_creation_platform_domains + and any(ml.link_analysis(.).final_dom.links, + network.whois(.href_url.domain).days_old < 30 + and .href_url.domain.tld in $suspicious_tlds + ) + ) +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Out of band pivot" + - "Evasion" +detection_methods: + - "URL analysis" + - "Whois" + - "HTML analysis" \ No newline at end of file From f6576759471204f0a4abb49ed11e0a0f56a442da Mon Sep 17 00:00:00 2001 From: CI Bot Date: Wed, 9 Sep 2026 15:19:24 +0000 Subject: [PATCH 2/4] Auto-format MQL and add rule IDs --- .../service_abuse_self_service_platform_new_domain.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detection-rules/service_abuse_self_service_platform_new_domain.yml b/detection-rules/service_abuse_self_service_platform_new_domain.yml index 6e93d62d80a..d241d894b75 100644 --- a/detection-rules/service_abuse_self_service_platform_new_domain.yml +++ b/detection-rules/service_abuse_self_service_platform_new_domain.yml @@ -19,4 +19,5 @@ tactics_and_techniques: detection_methods: - "URL analysis" - "Whois" - - "HTML analysis" \ No newline at end of file + - "HTML analysis" +id: "c4c38bbe-9d77-5040-9e78-92f2d50b3806" From 9757a7cf872b6c412ec0197641cb8f98e57618c8 Mon Sep 17 00:00:00 2001 From: Daniel Bolton Date: Wed, 9 Sep 2026 13:28:02 -0500 Subject: [PATCH 3/4] Add Attack surface reduction tag --- .../service_abuse_self_service_platform_new_domain.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-rules/service_abuse_self_service_platform_new_domain.yml b/detection-rules/service_abuse_self_service_platform_new_domain.yml index d241d894b75..9aa9675985d 100644 --- a/detection-rules/service_abuse_self_service_platform_new_domain.yml +++ b/detection-rules/service_abuse_self_service_platform_new_domain.yml @@ -10,7 +10,9 @@ source: | network.whois(.href_url.domain).days_old < 30 and .href_url.domain.tld in $suspicious_tlds ) - ) + ) +tags: + - "Attack surface reduction" attack_types: - "Credential Phishing" tactics_and_techniques: From a151d22dc09c3726c1a8fb90666815fa685af39b Mon Sep 17 00:00:00 2001 From: Daniel Bolton Date: Wed, 9 Sep 2026 13:28:57 -0500 Subject: [PATCH 4/4] Update description --- .../service_abuse_self_service_platform_new_domain.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detection-rules/service_abuse_self_service_platform_new_domain.yml b/detection-rules/service_abuse_self_service_platform_new_domain.yml index 9aa9675985d..d81fdb11f3a 100644 --- a/detection-rules/service_abuse_self_service_platform_new_domain.yml +++ b/detection-rules/service_abuse_self_service_platform_new_domain.yml @@ -1,5 +1,5 @@ name: "Service abuse: Self-service platform redirecting to newly registered suspicious domain" -description: "Detects inbound emails containing links to self-service creation platforms that ultimately redirect to newly registered domains (less than 30 days old) using suspicious top-level domains, indicating potential abuse of legitimate services to mask malicious redirect chains." +description: "Detects inbound emails containing links to self-service creation platforms that ultimately redirect to newly registered domains (less than 30 days old) using suspicious top-level domains, indicating potential abuse of legitimate services." type: "rule" severity: "medium" source: |