URL with Unicode U+2044 (⁄) or U+2215 (∕) characters

 1name: "URL with Unicode U+2044 (⁄) or U+2215 (∕) characters"
 2description: |
 3    Body of the message, or any links, contain the Unicode U+2044 (⁄) or U+2215 (∕) characters inside a URL.
 4type: "rule"
 5severity: "low"
 6authors:
 7  - twitter: "delivr_to"
 8references:
 9  - https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld-5e1e675e59a5
10source: |
11  type.inbound
12  and (
13    regex.icontains(body.plain.raw,
14                    'https?:\/\/[^\s⁄∕]+(?:\/[^\s⁄∕]+)*[⁄∕][^\s⁄∕]+'
15    )
16    or any(body.links, strings.contains(.href_url.url, '⁄', '∕'))
17  )  
18attack_types:
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Evasion"
22  - "Social engineering"
23detection_methods:
24  - "Content analysis"
25  - "URL analysis"
26id: "12069f5b-a774-53ba-8473-633291f71e84"