sublimemediumRule

Link: RTL text reversal with recipient email in URL

Flags inbound messages containing anchor tags styled with 'direction:rtl' to visually reverse displayed text—an evasion tactic against text-based scanning—where the underlying link URL also contains the recipient's email address, a common personalization technique used to track or validate targets in phishing links.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and recipients.to[0].email.domain.valid
and any(html.xpath(body.html, '//a').nodes,
        strings.icontains(.raw, 'direction:rtl')
        and any(.links,
                strings.contains(.href_url.url, recipients.to[0].email.email)
                // exclude common RTL languages
                and not regex.icontains(.display_text,
                                        '[\x{0590}-\x{08FF}\x{FB1D}-\x{FDFF}\x{FE70}-\x{FEFF}]'
                )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: RTL text reversal with recipient email in URL"
description: "Flags inbound messages containing anchor tags styled with 'direction:rtl' to visually reverse displayed text—an evasion tactic against text-based scanning—where the underlying link URL also contains the recipient's email address, a common personalization technique used to track or validate targets in phishing links."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and recipients.to[0].email.domain.valid
  and any(html.xpath(body.html, '//a').nodes,
          strings.icontains(.raw, 'direction:rtl')
          and any(.links,
                  strings.contains(.href_url.url, recipients.to[0].email.email)
                  // exclude common RTL languages
                  and not regex.icontains(.display_text,
                                          '[\x{0590}-\x{08FF}\x{FB1D}-\x{FDFF}\x{FE70}-\x{FEFF}]'
                  )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "HTML analysis"
  - "URL analysis"
id: "dbf5de4c-e105-5ca8-aa28-429fbdb61df4"