detection.wiki

Detection rules › Sublime MQL

Link: Excessive URL rewrite encoders

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects URLs with many (excessive) encoding patterns, including multiple instances of the same encoder or four or more distinct encoders. These techniques are commonly used to obfuscate malicious URLs and evade security filters.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEncryption, Evasion

Event coverage

Message attribute
body.current_thread
type

Rule body MQL

type.inbound
and any(body.current_thread.links,
        (
          // 4 or more encoders but they are all distinct
          length(.href_url.rewrite.encoders) >= 4
          and length(distinct(.href_url.rewrite.encoders)) >= 4
        )
)

Detection logic

Scope: inbound message.

Detects URLs with many (excessive) encoding patterns, including multiple instances of the same encoder or four or more distinct encoders. These techniques are commonly used to obfuscate malicious URLs and evade security filters.

  1. inbound message
  2. any of body.current_thread.links where all hold:
    • length(.href_url.rewrite.encoders) ≥ 4
    • length(distinct(.href_url.rewrite.encoders)) ≥ 4

Inspects: body.current_thread.links, body.current_thread.links[].href_url.rewrite.encoders, type.inbound.