Link: Base64-encoded redirect URL

calendar Oct 14, 2026  ·
Share on: linkedin copy

Identifies inbound messages containing links where the URL path includes a base64-encoded string that, once decoded, either reveals an embedded destination URL (via a 'u' parameter) or resolves to a known URL shortener domain. This obfuscation technique is commonly used to disguise the true destination of a link and evade detection.

Sublime rule (View on GitHub)

 1name: "Link: Base64-encoded redirect URL"
 2description: "Identifies inbound messages containing links where the URL path includes a base64-encoded string that, once decoded, either reveals an embedded destination URL (via a 'u' parameter) or resolves to a known URL shortener domain. This obfuscation technique is commonly used to disguise the true destination of a link and evade detection."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and 0 < length(body.current_thread.links) <= 3
 8  and any(body.links,
 9          any(regex.iextract(.href_url.path,
10                             '/[a-z]{1,3}/([A-Za-z0-9+/=_-]{20,})'
11              ),
12              any(regex.iextract(strings.decode_base64(.groups[0],
13                                                       ignore_padding=true
14                                 ),
15                                 '"u":"(https?://[^"]+)"'
16                  ),
17                  strings.parse_url(.groups[0]).domain.root_domain in $url_shorteners
18              )
19          )
20  )  
21attack_types:
22  - "Credential Phishing"
23tactics_and_techniques:
24  - "Open redirect"
25  - "Evasion"
26  - "Encryption"
27detection_methods:
28  - "URL analysis"
29  - "Content analysis"
30id: "1f4b9bc4-4b28-5e9a-9eb2-10b142c4afbb"
to-top