This rule detects credential phishing attempts that abuse legitimate Webex/Cisco infrastructure to deliver links pointing to suspicious destinations. It monitors inbound messages where the sender domain resolves to webex.com and evaluates every link in the current thread. If a link’s domain is not in an allowed trustlist (webex.com, cisco.com, ciscospark.com, wbx2.com, webexcontent.com) and one of the following conditions is met, the rule triggers: (1) the link’s domain is a known URL shortener, or its root domain matches a URL shortener, (2) the linked domain is newly registered ( Whois days_old < 90), or (3) the link uses an open-redirect encoder in the rewrite chain. This targets scenarios where attackers leverage Webex’s trusted sending reputation to deliver credential phishing lures (e.g., fake TikTok Business Account security alerts, bogus advertising partnership terms). Detection methods include URL analysis (domain checks, shortener identification, redirect encoders), Whois age checks, content analysis of links, and sender analysis to confirm provenance. The rule maps to Credential Phishing with tactics including Impersonation: Brand, Open Redirect, and Social Engineering. Operators should correlate alerts with potential campaigns and assess whether links genuinely require whitelisting or further user education to mitigate false positives.