From abe14e5aa6314210d4ea8437792c23a9eb11cbc3 Mon Sep 17 00:00:00 2001
From: "Brandon 2: Brandon Harder"
 <189403278+missingn0pe@users.noreply.github.com>
Date: Thu, 3 Sep 2026 13:59:47 -0500
Subject: [PATCH 1/3] Create spam_porkbun_newly_registered_domain.yml

Rule flags on newly registered sender domains less than 365 days old, using PorkBun's default DNS name servers.
---
 .../spam_porkbun_newly_registered_domain.yml  | 39 +++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 detection-rules/spam_porkbun_newly_registered_domain.yml

diff --git a/detection-rules/spam_porkbun_newly_registered_domain.yml b/detection-rules/spam_porkbun_newly_registered_domain.yml
new file mode 100644
index 00000000000..e8d030f9243
--- /dev/null
+++ b/detection-rules/spam_porkbun_newly_registered_domain.yml
@@ -0,0 +1,39 @@
+name: "Spam: Cold outreach from PorkBun-hosted newly registered domain""
+description: "Detects inbound messages from domains registered less than 365 days ago using PorkBun (porkbun.com) nameservers, where the message content is classified as B2B cold outreach by NLU analysis. The rule only flags senders who are either unsolicited or have a history of malicious/spam activity without any benign messages."
+type: "rule"
+severity: "low"
+source: |
+  type.inbound
+  // newly registered sender domain
+  and network.whois(sender.email.domain).days_old < 365
+  
+  // there are 4 name servers which have subdomains containing .ns
+  and length(network.whois(sender.email.domain).name_servers) == 4
+  and all(network.whois(sender.email.domain).name_servers,
+          strings.iends_with(.subdomain, 'ns') and .root_domain == 'porkbun.com'
+  )
+  
+  // nlu topic
+  and any(ml.nlu_classifier(body.current_thread.text).topics,
+          .name == 'B2B Cold Outreach'
+  )
+  
+  // sender profiles
+  and (
+    not profile.by_sender_email().solicited
+    or (
+      profile.by_sender().any_messages_malicious_or_spam
+      and not profile.by_sender().any_messages_benign
+    )
+  )
+  
+tags:
+  - "Attack surface reduction"
+attack_types:
+  - "Spam"
+tactics_and_techniques:
+  - "Social engineering"
+detection_methods:
+  - "Whois"
+  - "Natural Language Understanding"
+  - "Sender analysis"

From 00019b9b449ef6591cd8855a62773f8ca51a1a7d Mon Sep 17 00:00:00 2001
From: "Brandon 2: Brandon Harder"
 <189403278+missingn0pe@users.noreply.github.com>
Date: Thu, 3 Sep 2026 14:06:31 -0500
Subject: [PATCH 2/3] Update spam_porkbun_newly_registered_domain.yml

Double quote from copying rule name schema. Fixed.
---
 detection-rules/spam_porkbun_newly_registered_domain.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detection-rules/spam_porkbun_newly_registered_domain.yml b/detection-rules/spam_porkbun_newly_registered_domain.yml
index e8d030f9243..0a8ca12fa16 100644
--- a/detection-rules/spam_porkbun_newly_registered_domain.yml
+++ b/detection-rules/spam_porkbun_newly_registered_domain.yml
@@ -1,4 +1,4 @@
-name: "Spam: Cold outreach from PorkBun-hosted newly registered domain""
+name: "Spam: Cold outreach from PorkBun-hosted newly registered domain"
 description: "Detects inbound messages from domains registered less than 365 days ago using PorkBun (porkbun.com) nameservers, where the message content is classified as B2B cold outreach by NLU analysis. The rule only flags senders who are either unsolicited or have a history of malicious/spam activity without any benign messages."
 type: "rule"
 severity: "low"

From 5b072ecda03bae924ef10ce10d29b98e23dd0ee1 Mon Sep 17 00:00:00 2001
From: CI Bot <hello@sublimesecurity.com>
Date: Thu, 3 Sep 2026 19:08:09 +0000
Subject: [PATCH 3/3] Auto-format MQL and add rule IDs

---
 detection-rules/spam_porkbun_newly_registered_domain.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detection-rules/spam_porkbun_newly_registered_domain.yml b/detection-rules/spam_porkbun_newly_registered_domain.yml
index 0a8ca12fa16..a5ab8bdc6a0 100644
--- a/detection-rules/spam_porkbun_newly_registered_domain.yml
+++ b/detection-rules/spam_porkbun_newly_registered_domain.yml
@@ -37,3 +37,4 @@ detection_methods:
   - "Whois"
   - "Natural Language Understanding"
   - "Sender analysis"
+id: "985ac6a6-1dfd-5330-9bda-36da0da45f27"