Create service_abuse_self_service_platform_new_domain.yml

detection-rules/service_abuse_self_service_platform_new_domain.yml

@@ -0,0 +1,25 @@
+name: "Service abuse: Self-service platform redirecting to newly registered suspicious domain"
+description: "Detects inbound emails containing links to self-service creation platforms that ultimately redirect to newly registered domains (less than 30 days old) using suspicious top-level domains, indicating potential abuse of legitimate services."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and any(body.current_thread.links,
+          .href_url.domain.root_domain in $self_service_creation_platform_domains
+          and any(ml.link_analysis(.).final_dom.links,
+                  network.whois(.href_url.domain).days_old < 30
+                  and .href_url.domain.tld in $suspicious_tlds
+          )
+  )
+tags:
+  - "Attack surface reduction" 
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Out of band pivot"
+  - "Evasion"
+detection_methods:
+  - "URL analysis"
+  - "Whois"
+  - "HTML analysis"
+id: "c4c38bbe-9d77-5040-9e78-92f2d50b3806"