Sublime Security low experimental mql

URL with Unicode U+2044 (⁄) or U+2215 (∕) characters

Body of the message, or any links, contain the Unicode U+2044 (⁄) or U+2215 (∕) characters inside a URL.

View Source

Detection Logic

type.inbound
and (
  regex.icontains(body.plain.raw,
                  'https?:\/\/[^\s⁄∕]+(?:\/[^\s⁄∕]+)*[⁄∕][^\s⁄∕]+'
  )
  or any(body.links, strings.contains(.href_url.url, '⁄', '∕'))
)

Field Validations

Loading…

Comments (0)

Loading comments...