Sublime Security medium experimental mql

Link: Shortened URL with fragment matching subject

Detects messages containing shortened links where the URL fragment appears in the email subject line, indicating potential targeted link tracking or social engineering tactics.

View Source

Detection Logic

type.inbound
and any(body.current_thread.links,
        .href_url.domain.root_domain in $url_shorteners
        and .href_url.fragment is not null
        and length(.href_url.fragment) > 5
        and strings.contains(subject.subject, .href_url.fragment)
)

Field Validations

Loading…

Comments (0)

Loading comments...