sublimehighRule

Link: Delimited encoded path parameters (~V~ scheme)

This rule flags inbound messages containing a link with a repeating encoded pattern in the URL path, a technique used to obfuscate the true destination and evade static URL matching. The captured samples span a range of unrelated senders and lures - fake system/data access suspension notices, payment authorization failures, case submission confirmations, and backup storage reminders - all designed to create urgency and drive recipients to click through disguised links. The variety of spoofed sending domains and generic account/security themes suggests a shared link-obfuscation infrastructure being reused across many opportunistic lures rather than a single brand or campaign.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and any(body.links, regex.count(.href_url.path, '(?:~V~[NPQRSfhjlm]+)') >= 3)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Delimited encoded path parameters (~V~ scheme)"
description: "This rule flags inbound messages containing a link with a repeating encoded pattern in the URL path, a technique used to obfuscate the true destination and evade static URL matching. The captured samples span a range of unrelated senders and lures - fake system/data access suspension notices, payment authorization failures, case submission confirmations, and backup storage reminders - all designed to create urgency and drive recipients to click through disguised links. The variety of spoofed sending domains and generic account/security themes suggests a shared link-obfuscation infrastructure being reused across many opportunistic lures rather than a single brand or campaign."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(body.links, regex.count(.href_url.path, '(?:~V~[NPQRSfhjlm]+)') >= 3)
attack_types:
  - "Credential Phishing"
  - "Spam"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "c5f4af12-9328-5d83-9a6d-c2ea569ab709"