sublimehighRule

Link: .su domain link redirection from new sender domains

Catches inbound messages from recently established sending domains where a link in the body ultimately redirects through a .su (Soviet Union) top-level domain, despite the visible link pointing elsewhere. These messages often masquerade as academic transcript requests, invitations, or administrative notices, using legitimate-looking business or organizational senders to deliver links that funnel recipients through .su-based redirect infrastructure, a technique commonly used to obscure the final malicious destination.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and profile.by_sender_email().days_known < 7
and any(body.links,
        .href_url.domain.tld != "su"
        and any(ml.link_analysis(.).redirect_history, .domain.tld == "su")
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: .su domain link redirection from new sender domains"
description: "Catches inbound messages from recently established sending domains where a link in the body ultimately redirects through a .su (Soviet Union) top-level domain, despite the visible link pointing elsewhere. These messages often masquerade as academic transcript requests, invitations, or administrative notices, using legitimate-looking business or organizational senders to deliver links that funnel recipients through .su-based redirect infrastructure, a technique commonly used to obscure the final malicious destination."
type: "rule"
severity: "high"
source: |
  type.inbound
  and profile.by_sender_email().days_known < 7
  and any(body.links,
          .href_url.domain.tld != "su"
          and any(ml.link_analysis(.).redirect_history, .domain.tld == "su")
  )
attack_types:
  - "Credential Phishing"
  - "Spam"
tactics_and_techniques:
  - "Open redirect"
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "URL analysis"
  - "Sender analysis"
id: "8c0d84f6-bb81-5c6d-9dec-1124c326a109"