Create link_credential_theft_with_tycoon_url_struct

[hadojae]

Description

this is just another way to find the tycoon uri struct when its hidden behind a redirect

Associated hunts

• Hunt 1

[github-actions]

Test Rules Sync - Excluded

This PR contains rules that use ml.link_analysis, which is not supported in the test-rules environment.

The hunting-required label has been applied. These rules will need to be tested through alternative methods.

[hadojae]

testing well, looks good to go

[IndiaAce]

One small nit/consideration - I like this rule! I was wondering if you had this attached to a manual escalation / or if you could spawn one for tracked work on this. Would be nice to be able to review some of the customer hunts you ran for this given the fact that it's a LA excluded rule!

[hadojae]

One small nit/consideration - I like this rule! I was wondering if you had this attached to a manual escalation / or if you could spawn one for tracked work on this. Would be nice to be able to review some of the customer hunts you ran for this given the fact that it's a LA excluded rule!

Shared notion link via DM

[hadojae]

gonna hold off on this for a bit to see what happens with the takedown

[hadojae]

still active