sublimemediumRule

Attachment: Hex-encoded recipient email in URL fragment

Detects non-ICS attachments (PDFs, Office docs, HTML, etc.) that embed a URL whose fragment contains the recipient's email address encoded in hexadecimal. This technique is used to personalize or track clicks on malicious links delivered via file attachments rather than inline in the message body. Observed samples largely spoof financial or invoicing correspondence—such as invoice notices, AR aging reports, and cashflow or change-order updates—to lure recipients into opening the attachment and following the embedded link, often leading to credential phishing.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and any(attachments,
        not (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        and any(file.explode(.),
                any(.scan.url.urls,
                    strings.decode_hex(.fragment) == recipients.to[0].email.email
                )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Attachment: Hex-encoded recipient email in URL fragment"
description: "Detects non-ICS attachments (PDFs, Office docs, HTML, etc.) that embed a URL whose fragment contains the recipient's email address encoded in hexadecimal. This technique is used to personalize or track clicks on malicious links delivered via file attachments rather than inline in the message body. Observed samples largely spoof financial or invoicing correspondence—such as invoice notices, AR aging reports, and cashflow or change-order updates—to lure recipients into opening the attachment and following the embedded link, often leading to credential phishing."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          not (
            .file_type == "ics"
            or .file_extension == "ics"
            or .content_type in ("application/ics", "text/calendar")
          )
          and any(file.explode(.),
                  any(.scan.url.urls,
                      strings.decode_hex(.fragment) == recipients.to[0].email.email
                  )
          )
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Social engineering"
  - "Evasion"
  - "PDF"
detection_methods:
  - "File analysis"
  - "URL analysis"
  - "Content analysis"
id: "5637ad1e-2fbb-5856-9530-c6a0181d9134"