Detection rules › Sublime MQL
Link: Base64 encoded recipient address in URL fragment with hex subdomain
Detects links containing a 40-character hexadecimal subdomain with the recipient's email address base64 encoded in the URL fragment, a technique used to personalize malicious links and evade detection.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links,
length(.href_url.domain.subdomain) == 40
and regex.match(.href_url.domain.subdomain, '^[a-f0-9]{40}')
and any(strings.scan_base64(.href_url.fragment),
. == recipients.to[0].email.email
)
)
Detection logic
Scope: inbound message.
Detects links containing a 40-character hexadecimal subdomain with the recipient's email address base64 encoded in the URL fragment, a technique used to personalize malicious links and evade detection.
- inbound message
any of
body.linkswhere all hold:- length(.href_url.domain.subdomain) is 40
- .href_url.domain.subdomain matches '^[a-f0-9]{40}'
any of
strings.scan_base64(.href_url.fragment)where:- . is recipients.to[0].email.email
Inspects: body.links, body.links[].href_url.domain.subdomain, body.links[].href_url.fragment, recipients.to[0].email.email, type.inbound. Sensors: regex.match, strings.scan_base64.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
regex.match | regex | ^[a-f0-9]{40} |