sublimemediumRule

Link: Base64-encoded redirect URL

Identifies inbound messages containing links where the URL path includes a base64-encoded string that, once decoded, either reveals an embedded destination URL (via a 'u' parameter) or resolves to a known URL shortener domain. This obfuscation technique is commonly used to disguise the true destination of a link and evade detection.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027 T1573

defense-evasion

Detection Query

type.inbound
and 0 < length(body.current_thread.links) <= 3
and any(body.links,
        any(regex.iextract(.href_url.path,
                           '/[a-z]{1,3}/([A-Za-z0-9+/=_-]{20,})'
            ),
            any(regex.iextract(strings.decode_base64(.groups[0],
                                                     ignore_padding=true
                               ),
                               '"u":"(https?://[^"]+)"'
                ),
                strings.parse_url(.groups[0]).domain.root_domain in $url_shorteners
            )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Base64-encoded redirect URL"
description: "Identifies inbound messages containing links where the URL path includes a base64-encoded string that, once decoded, either reveals an embedded destination URL (via a 'u' parameter) or resolves to a known URL shortener domain. This obfuscation technique is commonly used to disguise the true destination of a link and evade detection."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and 0 < length(body.current_thread.links) <= 3
  and any(body.links,
          any(regex.iextract(.href_url.path,
                             '/[a-z]{1,3}/([A-Za-z0-9+/=_-]{20,})'
              ),
              any(regex.iextract(strings.decode_base64(.groups[0],
                                                       ignore_padding=true
                                 ),
                                 '"u":"(https?://[^"]+)"'
                  ),
                  strings.parse_url(.groups[0]).domain.root_domain in $url_shorteners
              )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Open redirect"
  - "Evasion"
  - "Encryption"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "1f4b9bc4-4b28-5e9a-9eb2-10b142c4afbb"