sublimemediumRule

Link: Suspicious URL path with binary character sequence

Detects inbound messages containing links with URLs that follow a specific suspicious pattern: starting with a forward slash, followed by a digit, uppercase letter, alphanumeric characters, a hyphen, more alphanumeric characters, and ending with exactly five binary digits (0s and 1s).

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(body.links,
        regex.contains(.href_url.path,
                       '^\/[0-9][A-Z][a-z0-9]+\-[a-z0-9]+[01]{5}$'
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Suspicious URL path with binary character sequence"
description: "Detects inbound messages containing links with URLs that follow a specific suspicious pattern: starting with a forward slash, followed by a digit, uppercase letter, alphanumeric characters, a hyphen, more alphanumeric characters, and ending with exactly five binary digits (0s and 1s)."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.links,
          regex.contains(.href_url.path,
                         '^\/[0-9][A-Z][a-z0-9]+\-[a-z0-9]+[01]{5}$'
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "URL analysis"
id: "e366f316-6e63-593f-aaeb-330ec90fb845"