sublimemediumRule

Link: Double base64-encoded URL path

Flags inbound messages containing two or more links whose URL paths contain long base64-encoded strings that, when decoded, reveal additional base64-like content. This double-encoding pattern is used to obscure the true destination of a link and evade automated URL inspection. Senders from highly trusted root domains that pass DMARC authentication are excluded.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1027 T1573 T1036

defense-evasion

Detection Query

type.inbound
and 2 <= length(filter(body.links,
                       regex.imatch(.href_url.path, '/[a-zA-Z0-9+/]{80,}={0,2}')
                       and regex.imatch(strings.decode_base64(regex.extract(.href_url.path,
                                                                            '/(?P<b>[a-zA-Z0-9+/]{80,}={0,2})'
                                                              )[0].named_groups["b"]
                                        ),
                                        '[a-zA-Z0-9+/]{60,}={0,2}'
                       )
                )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Double base64-encoded URL path"
description: "Flags inbound messages containing two or more links whose URL paths contain long base64-encoded strings that, when decoded, reveal additional base64-like content. This double-encoding pattern is used to obscure the true destination of a link and evade automated URL inspection. Senders from highly trusted root domains that pass DMARC authentication are excluded."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and 2 <= length(filter(body.links,
                         regex.imatch(.href_url.path, '/[a-zA-Z0-9+/]{80,}={0,2}')
                         and regex.imatch(strings.decode_base64(regex.extract(.href_url.path,
                                                                              '/(?P<b>[a-zA-Z0-9+/]{80,}={0,2})'
                                                                )[0].named_groups["b"]
                                          ),
                                          '[a-zA-Z0-9+/]{60,}={0,2}'
                         )
                  )
  )
  // negate highly trusted sender domains unless they fail DMARC authentication
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Encryption"
  - "Evasion"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "0265e6cb-26ff-5e6b-8135-9613e2c1e3e0"