Detection rules › Sublime MQL
Link: Obfuscation via userinfo with excessive URL padding
Identifies instances where a malicious actor leverages an excessively padded username within the userinfo portion of the URL to hide the true destination in preview windows.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Impersonation: Brand |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and 0 < length(body.links) < 100
and any(body.links,
// Detects deceptive URLs where the URL appears to start with a trusted domain (e.g., youtube.com@),
// but the actual destination domain is something else (e.g., malicious-site.com).
// In such cases, browsers interpret the portion before the '@' symbol as a username (e.g., youtube.com),
// and the URL resolves to the domain after the '@' symbol (malicious-site.com).
// This technique is often used in phishing attacks to trick users into trusting the link by showing a familiar domain.
// (?:%(?:25)?[a-f0-9]{2}){30,} is the key part which detects 30 or more URL encoded values before an @ (or a URL encoded @)
regex.icontains(coalesce(.href_url.rewrite.original, .href_url.url),
'https?(?:(?:%3a|\:)?(?:\/|%2f){2})[^\/]+(?:\s+|%(?:25)?[a-f0-9]{2}|0x[a-f0-9]+){30,}(?:@|%(?:25)?40)[^\/]+(?:\/|%(?:25)?2f)'
)
and not (
.href_url.domain.sld == "google"
and strings.istarts_with(.href_url.path, '/maps/place')
)
)
Detection logic
Scope: inbound message.
Identifies instances where a malicious actor leverages an excessively padded username within the userinfo portion of the URL to hide the true destination in preview windows.
- inbound message
all of:
- length(body.links) > 0
- length(body.links) < 100
any of
body.linkswhere all hold:- coalesce(.href_url.rewrite.original, .href_url.url) matches 'https?(?:(?:%3a|\\:)?(?:\\/|%2f){2})[^\\/]+(?:\\s+|%(?:25)?[a-f0-9]{2}|0x[a-f0-9]+){30,}(?:@|%(?:25)?40)[^\\/]+(?:\\/|%(?:25)?2f)'
not:
all of:
- .href_url.domain.sld is 'google'
- .href_url.path starts with '/maps/place'
Inspects: body.links, body.links[].href_url.domain.sld, body.links[].href_url.path, body.links[].href_url.rewrite.original, body.links[].href_url.url, type.inbound. Sensors: regex.icontains, strings.istarts_with.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | https?(?:(?:%3a|\:)?(?:\/|%2f){2})[^\/]+(?:\s+|%(?:25)?[a-f0-9]{2}|0x[a-f0-9]+){30,}(?:@|%(?:25)?40)[^\/]+(?:\/|%(?:25)?2f) |
body.links[].href_url.domain.sld | equals | google |
strings.istarts_with | prefix | /maps/place |