sublimehighRule

Link: Observed malicious URL path /redirect/redirect/

Inbound messages containing links whose path includes a repeated '/redirect/redirect/' segment. Observed lures include fake academic transcript notices, internal administrative notices, and generic invitations sent from a mix of compromised or unrelated legitimate domains, all leveraging the nested redirect to bypass link-scanning defenses and lead recipients to malicious landing pages.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and any(body.links, strings.icontains(.href_url.path, '/redirect/redirect/'))

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Observed malicious URL path /redirect/redirect/"
description: "Inbound messages containing links whose path includes a repeated '/redirect/redirect/' segment. Observed lures include fake academic transcript notices, internal administrative notices, and generic invitations sent from a mix of compromised or unrelated legitimate domains, all leveraging the nested redirect to bypass link-scanning defenses and lead recipients to malicious landing pages."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(body.links, strings.icontains(.href_url.path, '/redirect/redirect/'))
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Open redirect"
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "98e31dcf-f42c-5968-a6c7-0f664bb1217c"