[PR #3821] added rule: Link: URL shortener with copy-paste instructions and credential theft language

Author: github-actions[bot]

detection-rules/3821_link_credential_phishing_copy_paste_instructions.yml

@@ -0,0 +1,34 @@
+name: "Link: URL shortener with copy-paste instructions and credential theft language"
+description: "Detects messages containing only URL shorteners with copy-paste instructions and high-confidence credential theft language, typically used to evade URL analysis by requiring manual URL entry."
+type: "rule"
+severity: "low"
+source: |
+  type.inbound
+  and length(body.current_thread.links) > 0
+  and all(body.current_thread.links,
+          .href_url.domain.root_domain in $url_shorteners
+  )
+  and (
+    strings.icontains(body.current_thread.text, 'copy')
+    and (
+      strings.icontains(body.current_thread.text, 'pasting')
+      or strings.icontains(body.current_thread.text, 'paste')
+    )
+  )
+  and any(ml.nlu_classifier(body.current_thread.text).intents,
+          .name == 'cred_theft' and .confidence == 'high'
+  )
+
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Evasion"
+  - "Social engineering"
+detection_methods:
+  - "Content analysis"
+  - "Natural Language Understanding"
+  - "URL analysis"
+id: "7f48cc7d-8273-5f27-abdc-75959c317959"
+og_id: "a0a2c573-3686-590e-8715-fc4a32202c92"
+testing_pr: 3821
+testing_sha: 36c281258827da8100ba6f1b51171f8b9271ccf9