Detection rules › Sublime MQL
Link: URL scheme obfuscation via split HTML anchors
Detects URLs intentionally split across multiple adjacent HTML anchor tags to evade URL analysis and detection systems. This sophisticated evasion technique breaks the URL scheme (http/https) across separate anchor elements, rendering as: <a>h</a><a>ttp://malicious.com</a> The technique bypasses many security tools that expect complete, well-formed URLs while displaying a seemingly normal link to end users. This pattern is strongly associated with credential phishing and compromised email accounts. References: - Observed in wild credential phishing campaigns (2024-2025) - Evades traditional URL extraction and analysis tools
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud |
| Tactics and techniques | Evasion, HTML injection, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| type |
Rule body MQL
type.inbound
and length(body.current_thread.links) == 2
and length(filter(html.xpath(body.html, "//a").nodes,
.display_text == "h"
and any(.links, .href_url.scheme in ("http", "https"))
)
) == 1
and length(filter(html.xpath(body.html, "//a").nodes,
(
strings.starts_with(.display_text, "ttp://")
or strings.starts_with(.display_text, "ttps://")
)
and any(.links, .href_url.scheme in ("http", "https"))
)
) == 1
Detection logic
Scope: inbound message.
Detects URLs intentionally split across multiple adjacent HTML anchor tags to evade URL analysis and detection systems. This sophisticated evasion technique breaks the URL scheme (http/https) across separate anchor elements, rendering as: <a>h</a><a>ttp://malicious.com</a> The technique bypasses many security tools that expect complete, well-formed URLs while displaying a seemingly normal link to end users. This pattern is strongly associated with credential phishing and compromised email accounts. References: - Observed in wild credential phishing campaigns (2024-2025) - Evades traditional URL extraction and analysis tools
- inbound message
- length(body.current_thread.links) is 2
- length(filter(html.xpath(body.html, '//a').nodes, .display_text == 'h' and any(.links, .href_url.scheme in ('http', 'https')))) is 1
- length(filter(html.xpath(body.html, '//a').nodes, strings.starts_with(.display_text, 'ttp://') or strings.starts_with(.display_text, 'ttps://') and any(.links, .href_url.scheme in ('http', 'https')))) is 1
Inspects: body.current_thread.links, body.html, type.inbound. Sensors: html.xpath, strings.starts_with.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
html.xpath(body.html, '//a').nodes[].display_text | equals | h |
html.xpath(body.html, '//a').nodes[].links[].href_url.scheme | member | http |
html.xpath(body.html, '//a').nodes[].links[].href_url.scheme | member | https |
strings.starts_with | prefix | ttp:// |
strings.starts_with | prefix | ttps:// |