Link: Concatenated display text concealing duplicate URLs with PDF reference

calendar Jun 12, 2026  ·
Share on: linkedin copy

Detects messages where two identical links are displayed as a single continuous text string, with the second link containing 'PDF' in its display text. This technique can be used to obscure the true nature of links by making them appear as legitimate document references.

Sublime rule (View on GitHub)

 1name: "Link: Concatenated display text concealing duplicate URLs with PDF reference"
 2description: "Detects messages where two identical links are displayed as a single continuous text string, with the second link containing 'PDF' in its display text. This technique can be used to obscure the true nature of links by making them appear as legitimate document references."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(body.current_thread.text,
 8                       strings.concat(body.current_thread.links[0].display_text,
 9                                      body.current_thread.links[1].display_text
10                       )
11  )
12  and body.current_thread.links[0].href_url.url == body.current_thread.links[1].href_url.url
13  and strings.icontains(body.current_thread.links[1].display_text, 'pdf')  
14attack_types:
15  - "Credential Phishing"
16tactics_and_techniques:
17  - "Evasion"
18  - "Social engineering"
19detection_methods:
20  - "Content analysis"
21  - "URL analysis"
22id: "4cb86869-bb02-5903-bb7b-3cc2f88eb207"
to-top