Detection rules › Sublime MQL
Link: Suspicious URL path with binary character sequence
Detects inbound messages containing links with URLs that follow a specific suspicious pattern: starting with a forward slash, followed by a digit, uppercase letter, alphanumeric characters, a hyphen, more alphanumeric characters, and ending with exactly five binary digits (0s and 1s).
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links,
regex.contains(.href_url.path,
'^\/[0-9][A-Z][a-z0-9]+\-[a-z0-9]+[01]{5}$'
)
)
Detection logic
Scope: inbound message.
Detects inbound messages containing links with URLs that follow a specific suspicious pattern: starting with a forward slash, followed by a digit, uppercase letter, alphanumeric characters, a hyphen, more alphanumeric characters, and ending with exactly five binary digits (0s and 1s).
- inbound message
any of
body.linkswhere:- .href_url.path matches '^\\/[0-9][A-Z][a-z0-9]+\\-[a-z0-9]+[01]{5}$'
Inspects: body.links, body.links[].href_url.path, type.inbound. Sensors: regex.contains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
regex.contains | regex | ^\/[0-9][A-Z][a-z0-9]+\-[a-z0-9]+[01]{5}$ |