sublimemediumRule

Link: Suspicious recipient with timeout redirect

Detects inbound messages sent to self, invalid recipients, or undisclosed recipients containing links that, upon analysis, include a JavaScript setTimeout redirect. This technique delays redirection and appends URL fragments to evade static link inspection.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1059 T1036 T1027

executiondefense-evasioninitial-access

Detection Query

type.inbound
and (
  // self sender or invaild recipent domain or local parts match
  (
    length(recipients.to) == 1
    and (
      sender.email.email == recipients.to[0].email.email
      or recipients.to[0].email.domain.valid == false
      or sender.email.local_part == recipients.to[0].email.local_part
    )
  )
  // no recipients defined
  or (
    (
      length(recipients.to) == 0
      or all(recipients.to, .email.domain.valid == false)
    )
    and length(recipients.cc) == 0
    and length(recipients.bcc) == 0
  )
)
and 0 < length(body.current_thread.links) < 10
and any(body.current_thread.links,
        any(html.xpath(ml.link_analysis(., mode="aggressive").final_dom,
                       "//script"
            ).nodes,
            strings.istarts_with(.raw,
                                 '<script>setTimeout(function(){window.location="'
            )
            and strings.iends_with(.raw, '"+location.hash},3000)</script>')
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Suspicious recipient with timeout redirect"
description: "Detects inbound messages sent to self, invalid recipients, or undisclosed recipients containing links that, upon analysis, include a JavaScript setTimeout redirect. This technique delays redirection and appends URL fragments to evade static link inspection."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    // self sender or invaild recipent domain or local parts match
    (
      length(recipients.to) == 1
      and (
        sender.email.email == recipients.to[0].email.email
        or recipients.to[0].email.domain.valid == false
        or sender.email.local_part == recipients.to[0].email.local_part
      )
    )
    // no recipients defined
    or (
      (
        length(recipients.to) == 0
        or all(recipients.to, .email.domain.valid == false)
      )
      and length(recipients.cc) == 0
      and length(recipients.bcc) == 0
    )
  )
  and 0 < length(body.current_thread.links) < 10
  and any(body.current_thread.links,
          any(html.xpath(ml.link_analysis(., mode="aggressive").final_dom,
                         "//script"
              ).nodes,
              strings.istarts_with(.raw,
                                   '<script>setTimeout(function(){window.location="'
              )
              and strings.iends_with(.raw, '"+location.hash},3000)</script>')
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Scripting"
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "URL analysis"
  - "Javascript analysis"
  - "HTML analysis"
  - "Sender analysis"
id: "05c8c2d1-6018-5a3e-9e20-be1b41796e62"