Skip to content

Create service_abuse_surveymonkey_suspicious_outbound.yml#4805

Open
keaton-sublime wants to merge 5 commits into
mainfrom
keaton-sublime.fn.ESC-17034.service_abuse
Open

Create service_abuse_surveymonkey_suspicious_outbound.yml#4805
keaton-sublime wants to merge 5 commits into
mainfrom
keaton-sublime.fn.ESC-17034.service_abuse

Conversation

@keaton-sublime

@keaton-sublime keaton-sublime commented Jul 6, 2026

Copy link
Copy Markdown
Member

Description

Detects SurveyMonkey abuse with links inside embedded tables.

Associated samples

Associated hunts

@keaton-sublime keaton-sublime added the in-test-rules PR is in our testing suite to collect telemetry label Jul 6, 2026
github-actions Bot added a commit that referenced this pull request Jul 6, 2026
github-actions Bot added a commit that referenced this pull request Jul 6, 2026
@keaton-sublime keaton-sublime added the review-needed Indicates that a PR is waiting for review label Jul 8, 2026
@keaton-sublime keaton-sublime marked this pull request as ready for review July 8, 2026 12:41
@keaton-sublime keaton-sublime requested a review from a team July 8, 2026 12:41
@keaton-sublime keaton-sublime requested a review from a team as a code owner July 8, 2026 12:41
@keaton-sublime

Copy link
Copy Markdown
Member Author

Marking as review needed/ready for review - Telemetry looks good in test rules over the last two days and the shared hunt has been updated to include those hits.

@zoomequipd zoomequipd self-assigned this Jul 8, 2026
Comment thread detection-rules/service_abuse_surveymonkey_suspicious_outbound.yml Outdated
@keaton-sublime

Copy link
Copy Markdown
Member Author

updated logic per the feedback request and here's the new hunts:

old version only
new version only

The results show that the we have parity between the two versions of the rules 👍

github-actions Bot added a commit that referenced this pull request Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants