sublimemediumRule

Link: Concatenated display text concealing duplicate URLs with PDF reference

Detects messages where two identical links are displayed as a single continuous text string, with the second link containing 'PDF' in its display text. This technique can be used to obscure the true nature of links by making them appear as legitimate document references.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and strings.contains(body.current_thread.text,
                     strings.concat(body.current_thread.links[0].display_text,
                                    body.current_thread.links[1].display_text
                     )
)
and body.current_thread.links[0].href_url.url == body.current_thread.links[1].href_url.url
and strings.icontains(body.current_thread.links[1].display_text, 'pdf')

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Concatenated display text concealing duplicate URLs with PDF reference"
description: "Detects messages where two identical links are displayed as a single continuous text string, with the second link containing 'PDF' in its display text. This technique can be used to obscure the true nature of links by making them appear as legitimate document references."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and strings.contains(body.current_thread.text,
                       strings.concat(body.current_thread.links[0].display_text,
                                      body.current_thread.links[1].display_text
                       )
  )
  and body.current_thread.links[0].href_url.url == body.current_thread.links[1].href_url.url
  and strings.icontains(body.current_thread.links[1].display_text, 'pdf')
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "URL analysis"
id: "4cb86869-bb02-5903-bb7b-3cc2f88eb207"