detection.wiki

Detection rules › Sublime MQL

Outlook hyperlink bypass: left-to-right mark (LRM) in base HTML tag

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

The exploit involves tricking Outlook for Windows into displaying a fake domain while opening another one. This is achieved by adding a <base> HTML tag with a fake domain and a left-to-right mark (Unicode U+200E). Links within <a> tags will display the fake domain but open the actual domain when clicked on.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Exploit

Event coverage

Message attribute
body.html
type

Rule body MQL

type.inbound
and regex.contains(body.html.raw, 'base.{0,100}\x{200E}/>')

Detection logic

Scope: inbound message.

The exploit involves tricking Outlook for Windows into displaying a fake domain while opening another one. This is achieved by adding a <base> HTML tag with a fake domain and a left-to-right mark (Unicode U+200E). Links within <a> tags will display the fake domain but open the actual domain when clicked on.

  1. inbound message
  2. body.html.raw matches 'base.{0,100}\\x{200E}/>'

Inspects: body.html.raw, type.inbound. Sensors: regex.contains.

Indicators matched (1)

FieldMatchValue
regex.containsregexbase.{0,100}\x{200E}/>