detection.wiki

Detection rules › Sublime MQL

Link: Display text with excessive right-to-left mark characters

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects links where the display text contains a high concentration of Unicode right-to-left mark characters (U+200F), which may be used to obfuscate or manipulate the visual representation of the link text to deceive recipients.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion

Event coverage

Message attribute
body
type

Rule body MQL

type.inbound
and length(html.xpath(body.html, '//a').nodes) < 10
and any(html.xpath(body.html, '//a').nodes,
        regex.icontains(.inner_text, '(?:[A-Za-z]\x{200F}){2,}[A-Za-z]')
)

Detection logic

Scope: inbound message.

Detects links where the display text contains a high concentration of Unicode right-to-left mark characters (U+200F), which may be used to obfuscate or manipulate the visual representation of the link text to deceive recipients.

  1. inbound message
  2. length(html.xpath(body.html, '//a').nodes) < 10
  3. any of html.xpath(body.html, '//a').nodes where:
    • .inner_text matches '(?:[A-Za-z]\\x{200F}){2,}[A-Za-z]'

Inspects: body.html, type.inbound. Sensors: html.xpath, regex.icontains.

Indicators matched (1)

FieldMatchValue
regex.icontainsregex(?:[A-Za-z]\x{200F}){2,}[A-Za-z]