Subject: Hex-encoded recipient address in subject

calendar Nov 3, 2026  ·
Share on: linkedin copy

Flags inbound messages where the subject line contains a long hexadecimal string that, when decoded, matches the recipient's email address. This technique is commonly used to personalize or track delivery of bulk unsolicited messages while obscuring the encoded data from simple string matching.

Sublime rule (View on GitHub)

 1name: "Subject: Hex-encoded recipient address in subject"
 2description: "Flags inbound messages where the subject line contains a long hexadecimal string that, when decoded, matches the recipient's email address. This technique is commonly used to personalize or track delivery of bulk unsolicited messages while obscuring the encoded data from simple string matching."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(regex.iextract(subject.base, '[0-9a-f]{20,}'),
 8          strings.decode_hex(.full_match) in map(recipients.to, .email.email)
 9  )  
10attack_types:
11  - "Credential Phishing"
12tactics_and_techniques:
13  - "Evasion"
14  - "Encryption"
15detection_methods:
16  - "Content analysis"
17  - "Header analysis"
18id: "310a5e51-1f39-5bfe-a448-f31bb3ac8913"
to-top