Link: Suspicious URL with recipient targeting and special characters

calendar Jan 8, 2026  ·
Share on: linkedin copy

Detects messages containing links with special characters in the path that include the recipient's email address in either the URL path or fragment, potentially encoded in base64. The URLs have a simple path structure and may end with suspicious patterns.

Sublime rule (View on GitHub)

 1name: "Link: Suspicious URL with recipient targeting and special characters"
 2description: "Detects messages containing links with special characters in the path that include the recipient's email address in either the URL path or fragment, potentially encoded in base64. The URLs have a simple path structure and may end with suspicious patterns."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(recipients.to) == 1
 8  and recipients.to[0].email.domain.valid
 9  and any(body.current_thread.links,
10          // special char in the path
11          (
12            strings.icontains(.href_url.path, '!')
13            or strings.icontains(.href_url.path, '@')
14          )
15          // a single path
16          and strings.count(.href_url.path, '/') == 2
17          and (
18            strings.icontains(.href_url.path, '/$')
19            or strings.icontains(.href_url.path, '/*')
20          )
21          and (
22            (
23              strings.icontains(.href_url.path, recipients.to[0].email.email)
24              or strings.icontains(.href_url.fragment,
25                                   recipients.to[0].email.email
26              )
27              or any(strings.scan_base64(.href_url.path, ignore_padding=true),
28                     strings.icontains(., recipients.to[0].email.email)
29              )
30              or any(strings.scan_base64(.href_url.fragment, ignore_padding=true),
31                     strings.icontains(., recipients.to[0].email.email)
32              )
33            )
34          )
35  )  
36
37attack_types:
38  - "Credential Phishing"
39tactics_and_techniques:
40  - "Social engineering"
41  - "Evasion"
42detection_methods:
43  - "URL analysis"
44  - "Content analysis"
45id: "e808be3a-e00c-5565-87f7-d0ca0411650d"
to-top