Link: Randomly generated subdomain

calendar Oct 21, 2026  ·
Share on: linkedin copy

Identifies inbound messages containing links where the subdomain follows a pattern of letters combined with a long hexadecimal string, a hallmark of auto-generated or algorithmically created hosting infrastructure often used to evade detection.

Sublime rule (View on GitHub)

 1name: "Link: Randomly generated subdomain"
 2description: "Identifies inbound messages containing links where the subdomain follows a pattern of letters combined with a long hexadecimal string, a hallmark of auto-generated or algorithmically created hosting infrastructure often used to evade detection."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          regex.imatch(.href_url.domain.subdomain, '[a-z]{3,30}[0-9a-f]{32}')
 9  )  
10attack_types:
11  - "Credential Phishing"
12tactics_and_techniques:
13  - "Evasion"
14detection_methods:
15  - "URL analysis"
16id: "24d923cc-8c80-5e4a-86bf-bd4bbd755121"
to-top