sublimehighRule

Link: Credential phishing with obfuscated JavaScript redirect

Flags inbound messages where the current thread contains between 1 and 9 links and NLU classification identifies credential theft intent with at least medium confidence. Additionally requires that aggressive link analysis reveal a redirect chain containing a query parameter with an obfuscated JavaScript payload that uses an onerror handler combined with atob and decodeURIComponent to dynamically redirect the browser, a technique commonly used to evade static URL scanning while ultimately routing victims to a credential harvesting page.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027 T1059

defense-evasionexecutioninitial-access

Detection Query

type.inbound
and 0 < length(body.current_thread.links) < 10
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)
and any(body.current_thread.links,
        any(ml.link_analysis(., mode="aggressive").redirect_history,
            any(flatten(values(.query_params_decoded)),
                strings.icontains(.,
                                  'onerror="window.location=decodeURIComponent(atob('
                )
            )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Credential phishing with obfuscated JavaScript redirect"
description: "Flags inbound messages where the current thread contains between 1 and 9 links and NLU classification identifies credential theft intent with at least medium confidence. Additionally requires that aggressive link analysis reveal a redirect chain containing a query parameter with an obfuscated JavaScript payload that uses an onerror handler combined with atob and decodeURIComponent to dynamically redirect the browser, a technique commonly used to evade static URL scanning while ultimately routing victims to a credential harvesting page."
type: "rule"
severity: "high"
source: |
  type.inbound
  and 0 < length(body.current_thread.links) < 10
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name == 'cred_theft' and .confidence != 'low'
  )
  and any(body.current_thread.links,
          any(ml.link_analysis(., mode="aggressive").redirect_history,
              any(flatten(values(.query_params_decoded)),
                  strings.icontains(.,
                                    'onerror="window.location=decodeURIComponent(atob('
                  )
              )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Open redirect"
  - "Evasion"
  - "Scripting"
  - "Social engineering"
detection_methods:
  - "Natural Language Understanding"
  - "URL analysis"
  - "Javascript analysis"
id: "cc585e3d-113c-53d1-9212-d966f0e4d94c"