sublimemediumRule

Link: URL using underscore-dot substitution in display text

Detects inbound messages containing links where the display text starts with 'https://' and uses an underscore followed by 'com/' in place of a standard dot-com domain format (e.g., 'example_com/'). This technique is used to bypass display text URL parsing, as the malformed URL cannot be resolved by standard URL parsers.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and any(body.links,
        strings.starts_with(.display_text, 'https://')
        and strings.contains(.display_text, '_com/')
        and not strings.contains(.display_text, '.com/')
        and strings.parse_url(.display_text).url is null
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: URL using underscore-dot substitution in display text"
description: "Detects inbound messages containing links where the display text starts with 'https://' and uses an underscore followed by 'com/' in place of a standard dot-com domain format (e.g., 'example_com/'). This technique is used to bypass display text URL parsing, as the malformed URL cannot be resolved by standard URL parsers."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.links,
          strings.starts_with(.display_text, 'https://')
          and strings.contains(.display_text, '_com/')
          and not strings.contains(.display_text, '.com/')
          and strings.parse_url(.display_text).url is null
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "802edfc6-5031-59bb-831b-16d0772b2b96"