Link: Double base64-encoded URL path

calendar Aug 24, 2026  ·
Share on: linkedin copy

Flags inbound messages containing two or more links whose URL paths contain long base64-encoded strings that, when decoded, reveal additional base64-like content. This double-encoding pattern is used to obscure the true destination of a link and evade automated URL inspection. Senders from highly trusted root domains that pass DMARC authentication are excluded.

Sublime rule (View on GitHub)

 1name: "Link: Double base64-encoded URL path"
 2description: "Flags inbound messages containing two or more links whose URL paths contain long base64-encoded strings that, when decoded, reveal additional base64-like content. This double-encoding pattern is used to obscure the true destination of a link and evade automated URL inspection. Senders from highly trusted root domains that pass DMARC authentication are excluded."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and 2 <= length(filter(body.links,
 8                         regex.imatch(.href_url.path, '/[a-zA-Z0-9+/]{80,}={0,2}')
 9                         and regex.imatch(strings.decode_base64(regex.extract(.href_url.path,
10                                                                              '/(?P<b>[a-zA-Z0-9+/]{80,}={0,2})'
11                                                                )[0].named_groups["b"]
12                                          ),
13                                          '[a-zA-Z0-9+/]{60,}={0,2}'
14                         )
15                  )
16  )
17  // negate highly trusted sender domains unless they fail DMARC authentication
18  and not (
19    sender.email.domain.root_domain in $high_trust_sender_root_domains
20    and coalesce(headers.auth_summary.dmarc.pass, false)
21  )  
22attack_types:
23  - "Credential Phishing"
24tactics_and_techniques:
25  - "Encryption"
26  - "Evasion"
27detection_methods:
28  - "URL analysis"
29  - "Content analysis"
30id: "0265e6cb-26ff-5e6b-8135-9613e2c1e3e0"
to-top