detection.wiki

Detection rules › Sublime MQL

Link: URL fragment with hexadecimal pattern obfuscation

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects links containing URL fragments with repeating hexadecimal patterns, commonly used to obfuscate malicious destinations or bypass security filters.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion

Event coverage

Message attribute
body
body.links (collection)
type

Rule body MQL

type.inbound
and any(body.links,
        regex.contains(.href_url.fragment, '.html\/\?(?:[a-f0-9]{2}\.){12,}')
)

Detection logic

Scope: inbound message.

Detects links containing URL fragments with repeating hexadecimal patterns, commonly used to obfuscate malicious destinations or bypass security filters.

  1. inbound message
  2. any of body.links where:
    • .href_url.fragment matches '.html\\/\\?(?:[a-f0-9]{2}\\.){12,}'

Inspects: body.links, body.links[].href_url.fragment, type.inbound. Sensors: regex.contains.

Indicators matched (1)

FieldMatchValue
regex.containsregex.html\/\?(?:[a-f0-9]{2}\.){12,}