Link: PIF File from Suspicious Source (AgentTesla)

type.inbound

and any(body.links,
    1 of (
        // Original AgentTesla Link
        network.whois(.href_url.domain).registrant_country_code =~ "RU",
        // Other suspicious attributes of link
        network.whois(.href_url.domain).days_old < 30,
        .href_url.domain.domain in $free_subdomain_hosts,
        .href_url.domain.domain in $free_file_hosts,
        .href_url.domain.root_domain in $free_subdomain_hosts,
        .href_url.domain.root_domain in $free_file_hosts,
        sender.email.domain.domain == "delivrto.me"
    )

    and 1 of (
        // Static URL analysis, link ends with PIF
        strings.iends_with(.href_url.url, ".pif"),

        // Payload fetch, file is PIF or has NSIS indicators
        any(ml.link_analysis(.href_url).files_downloaded,
            .file_extension == "pif" or 
            any(file.explode(.),
                any(.flavors.yara, . == "mz_file") and 
                any(.scan.strings.strings,
                    strings.ilike(., 
                        "*Nullsoft Install System*", 
                        "*NSIS*"
                    )
                )
            ) 
        )
    )
)

and (
  (
  profile.by_sender().prevalence in ("new", "outlier")
  and not profile.by_sender().solicited
  ) 
  or sender.email.domain.domain == "delivrto.me"
)