Create link_self_sender_doc_lure_external_domain.yml

detection-rules/link_self_sender_doc_lure_external_domain.yml

@@ -0,0 +1,47 @@
+name: "Link: Self-sender with document lure and external domain"
+description: |
+  Detects self-addressed messages from authenticated business email accounts containing document-sharing language and links to external domains.
+  These messages often indicate compromised account testing where attackers validate phishing infrastructure before targeting external recipients.
+  The combination of DMARC authentication, document lure patterns, external links, and ML-detected credential theft intent suggests an attacker is using a legitimate compromised account to test their phishing campaign.
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  // self sender
+  and sender.email.email == recipients.to[0].email.email
+  // auth passes
+  and coalesce(headers.auth_summary.dmarc.pass, false)
+  // not free email
+  and sender.email.domain.root_domain not in $free_email_providers
+  // Document/file language
+  and regex.icontains(body.current_thread.text,
+                      '\b(document[s]|file|invoice|report|statement|payment)\b'
+  )
+  and any(body.links,
+          .href_url.domain.root_domain != sender.email.domain.root_domain
+          and .href_url.domain.root_domain not in $free_file_hosts
+  )
+  and not any(headers.reply_to,
+              .email.domain.domain in $org_domains
+              or .email.domain.root_domain in $high_trust_sender_root_domains
+              or .email.domain.root_domain in ("docusign.net", "docusign.com")
+  )
+  // ML signals credential phishing
+  and any(ml.nlu_classifier(body.current_thread.text).intents,
+          .name == "cred_theft" and .confidence != "low"
+  )
+  // Not password reset, compromised account emails
+  and not (
+    strings.icontains(body.current_thread.text, "compromised")
+    or strings.icontains(body.current_thread.text, "password")
+  )
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Social engineering"
+detection_methods:
+  - "Content analysis"
+  - "Natural Language Understanding"
+  - "Sender analysis"
+  - "URL analysis"
+id: "dce9e334-7766-5bd8-b464-b3a7b6d22d0c"