[PR sublime-security#3747] added rule: Link: Suspicious URL with recipient targeting and special characters

Author: github-actions[bot]

detection-rules/3747_link_url_with_recipient_targeting_and_special_characters.yml

@@ -0,0 +1,49 @@
+name: "Link: Suspicious URL with recipient targeting and special characters"
+description: "Detects messages containing links with special characters in the path that include the recipient's email address in either the URL path or fragment, potentially encoded in base64. The URLs have a simple path structure and may end with suspicious patterns."
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  and length(recipients.to) == 1
+  and recipients.to[0].email.domain.valid
+  and any(body.current_thread.links,
+          // a single path
+          strings.count(.href_url.path, '/') == 2
+          // special chars
+          and (
+            strings.icontains(.href_url.path, '/$')
+            or strings.icontains(.href_url.path, '/*')
+            or strings.icontains(.href_url.url, '/#')
+          )
+          // and not where the # is within a directory structure
+          // which is followed by url query params (the ? or = )
+          // had some fps based on an unsual use of this char within paths where url query param
+          and not regex.icontains(.href_url.url, '\/[^\/]*#[^\/]*\/[^$]*\?', )
+          
+          // also not where it's #! or #, which causes the fragment to start with punctuation unless that puncutation is a ?
+          // we use coalesce to account for where there is no fragment and the regex.icontains returns null
+          and not coalesce(regex.icontains(.href_url.fragment, '^[!,]'), false)
+  
+          // recipient email in url or path
+          and (
+            strings.icontains(.href_url.path, recipients.to[0].email.email)
+            or any(strings.scan_base64(.href_url.url,
+                                       ignore_padding=true,
+                                       format="url"
+                   ),
+                   strings.icontains(., recipients.to[0].email.email)
+            )
+          )
+  )
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Social engineering"
+  - "Evasion"
+detection_methods:
+  - "URL analysis"
+  - "Content analysis"
+id: "35c17ab0-86d1-5235-8bef-1eff9010e139"
+og_id: "e808be3a-e00c-5565-87f7-d0ca0411650d"
+testing_pr: 3747
+testing_sha: 1a6d783968c36bc8ef7c2ce3179d7cc833bade65