Link: Malformed subdomain ending in hyphen
Flags messages containing links whose subdomain ends in a dash, a construction that violates RFC 952 hostname standards and is often used to obscure the true destination domain or mimic a legitimate brand's naming convention. This technique appears in messages using business lures such as fake NDA addendums, confidential annexes, and missed voicemail notifications to drive recipients to attacker-controlled infrastructure disguised as trusted services.
Sublime rule (View on GitHub)
1name: "Link: Malformed subdomain ending in hyphen"
2description: "Flags messages containing links whose subdomain ends in a dash, a construction that violates RFC 952 hostname standards and is often used to obscure the true destination domain or mimic a legitimate brand's naming convention. This technique appears in messages using business lures such as fake NDA addendums, confidential annexes, and missed voicemail notifications to drive recipients to attacker-controlled infrastructure disguised as trusted services."
3type: "rule"
4severity: "low"
5references:
6 - "https://isc.sans.edu/diary/One+URL+Three+Different+Tricks/33366"
7 - " https://www.rfc-editor.org/info/rfc952/"
8source: |
9 type.inbound
10 and any(body.links,
11 .href_url.scheme != "mailto"
12 and strings.iends_with(.href_url.domain.subdomain, '-')
13 )
14tags:
15 - "Attack surface reduction"
16attack_types:
17 - "Credential Phishing"
18tactics_and_techniques:
19 - "Social engineering"
20 - "Lookalike domain"
21 - "Impersonation: Brand"
22 - "Impersonation: Employee"
23detection_methods:
24 - "URL analysis"
25 - "Content analysis"
26id: "16fbcf85-be63-54c5-a36e-ce180f7499d1"