Link: Unformatted template with literal placeholder in mailto link

calendar Aug 3, 2026  ·
Share on: linkedin copy

Detects inbound messages containing mailto links whose href URL still contains an unresolved template placeholder, indicating the sender used a templating system but failed to substitute real values before sending. Two patterns are flagged: an '@{domain}' placeholder, treated as a strong standalone signal; and a '{RECIPIENT_EMAIL}' or '{SENDER_EMAIL}' placeholder (case-insensitive, allowing an underscore or space before 'EMAIL'), which fires only when the NLU classifier detects high-confidence credential-theft (cred_theft) or business-email-compromise (bec) intent in the current thread, suppressing benign templated mail.

Sublime rule (View on GitHub)

 1name: "Link: Unformatted template with literal placeholder in mailto link"
 2description: "Detects inbound messages containing mailto links whose href URL still contains an unresolved template placeholder, indicating the sender used a templating system but failed to substitute real values before sending. Two patterns are flagged: an '@{domain}' placeholder, treated as a strong standalone signal; and a '{RECIPIENT_EMAIL}' or '{SENDER_EMAIL}' placeholder (case-insensitive, allowing an underscore or space before 'EMAIL'), which fires only when the NLU classifier detects high-confidence credential-theft (cred_theft) or business-email-compromise (bec) intent in the current thread, suppressing benign templated mail."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.scheme == "mailto"
 9          and strings.contains(.href_url.url, '{')
10          and strings.contains(.href_url.url, '}')
11          and (
12            // @{domain} pattern is strong
13            regex.icontains(.href_url.url, '@\s*{\s*domain\s*}')
14            // combine {RECIPIENT_EMAIL} and {SENDER EMAIL} with NLU to remove a bunch of
15            // benign use cases
16            or (
17              regex.icontains(.href_url.url,
18                              '{\s*(?:RECIPIENT|SENDER)[_\s]?EMAIL\s*}'
19              )
20              and any(ml.nlu_classifier(body.current_thread.text).intents,
21                      .name in ("cred_theft", "bec") and .confidence == "high"
22              )
23            )
24          )
25  )  
26attack_types:
27  - "Credential Phishing"
28tactics_and_techniques:
29  - "Social engineering"
30  - "Evasion"
31detection_methods:
32  - "URL analysis"
33  - "Content analysis"
34id: "b27e9e2a-a979-584f-9da7-a2936829ae0c"
to-top