Observed IOC: Malicious URLs in body links

calendar Apr 24, 2026  ·
Share on: linkedin copy

Detects inbound messages containing specific known malicious URLs in the message body. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Sublime rule (View on GitHub)

 1name: "Observed IOC: Malicious URLs in body links"
 2description: "Detects inbound messages containing specific known malicious URLs in the message body. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed."
 3type: "rule"
 4severity: "high"
 5source: |
 6  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
 7  // Managed by automated IOC system
 8  type.inbound
 9  and any(body.current_thread.links,
10          hash.sha256(.href_url.url) in (
11            '4256b75f07d4b2c28120637f3c5e492ee9037e6c9b815cf6bd849e73cfb59ab0', // Observed malicious Zoom impersonation URL
12            '9cbae8df195b24ca88dda3a5ce1c867b08243adadcfc65d36f7e9c2c3b601ac8' // Observed malicious Zoom impersonation URL
13          )
14  )  
15
16attack_types:
17  - "Credential Phishing"
18  - "Malware/Ransomware"
19tactics_and_techniques:
20  - "Evasion"
21  - "Social engineering"
22detection_methods:
23  - "URL analysis"
24  - "Content analysis"
25id: "a6b7c8d9-e0f1-4a3b-ac5d-e6f7a8b9c0d1"
to-top