Sublime Security high experimental mql

Link: URL fragment with hexadecimal pattern obfuscation

Detects links containing URL fragments with repeating hexadecimal patterns, commonly used to obfuscate malicious destinations or bypass security filters.

View Source

Detection Logic

type.inbound
and any(body.links,
        regex.contains(.href_url.fragment, '.html\/\?(?:[a-f0-9]{2}\.){12,}')
)

Field Validations

Loading…

Comments (0)

Loading comments...