sublimelowRule

Evasion: Suspicious TLD link redirecting to Wikipedia

Flags inbound messages containing links with domains registered under suspicious top-level domains that redirect to Wikipedia when analyzed. This behavior indicates the link is detecting automated sandbox or security analysis tools and serving benign content to evade detection, while likely delivering malicious content to real users.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(body.current_thread.links,
        .href_url.domain.tld in $suspicious_tlds
        and ml.link_analysis(.).effective_url.url in (
          'https://www.wikipedia.org/'
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Evasion: Suspicious TLD link redirecting to Wikipedia"
description: "Flags inbound messages containing links with domains registered under suspicious top-level domains that redirect to Wikipedia when analyzed. This behavior indicates the link is detecting automated sandbox or security analysis tools and serving benign content to evade detection, while likely delivering malicious content to real users."
type: "rule"
severity: "low"
source: |
  type.inbound
  and any(body.current_thread.links,
          .href_url.domain.tld in $suspicious_tlds
          and ml.link_analysis(.).effective_url.url in (
            'https://www.wikipedia.org/'
          )
  )
attack_types:
  - "Credential Phishing"
  - "Spam"
tactics_and_techniques:
  - "Evasion"
  - "Open redirect"
detection_methods:
  - "URL analysis"
id: "c4567096-6e36-578e-b070-a51c01953287"