sublimelowRule

Link: Malformed subdomain ending in hyphen

Flags messages containing links whose subdomain ends in a dash, a construction that violates RFC 952 hostname standards and is often used to obscure the true destination domain or mimic a legitimate brand's naming convention. This technique appears in messages using business lures such as fake NDA addendums, confidential annexes, and missed voicemail notifications to drive recipients to attacker-controlled infrastructure disguised as trusted services.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1583.001 T1598.003 T1534

initial-access

Detection Query

type.inbound
and any(body.links,
        .href_url.scheme != "mailto"
        and strings.iends_with(.href_url.domain.subdomain, '-')
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

Tags

Attack surface reduction

Raw Content

name: "Link: Malformed subdomain ending in hyphen"
description: "Flags messages containing links whose subdomain ends in a dash, a construction that violates RFC 952 hostname standards and is often used to obscure the true destination domain or mimic a legitimate brand's naming convention. This technique appears in messages using business lures such as fake NDA addendums, confidential annexes, and missed voicemail notifications to drive recipients to attacker-controlled infrastructure disguised as trusted services."
type: "rule"
severity: "low"
references:
  - "https://isc.sans.edu/diary/One+URL+Three+Different+Tricks/33366"
  - " https://www.rfc-editor.org/info/rfc952/"
source: |
  type.inbound
  and any(body.links,
          .href_url.scheme != "mailto"
          and strings.iends_with(.href_url.domain.subdomain, '-')
  )
tags:
 - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Lookalike domain"
  - "Impersonation: Brand"
  - "Impersonation: Employee"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "16fbcf85-be63-54c5-a36e-ce180f7499d1"