Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Email_Redirection_Spoofing_Feb25

Detects redirect spoofing in embedded URLs. This technique is used by threat actors to obscure the actual destination of a link

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Jonathan Peters (cod3nym)
Date
2025-02-20
Modified
2025-03-20
Score / Quality
70 / 85

What this rule detects

Detects redirect spoofing in embedded URLs. This technique is used by threat actors to obscure the actual destination of a link

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-email-redirection-spoofing-feb25.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_Email_Redirection_Spoofing_Feb25
{
	meta:
		description = "Detects redirect spoofing in embedded URLs. This technique is used by threat actors to obscure the actual destination of a link"
		author = "Jonathan Peters (cod3nym)"
		id = "bf3a2b06-4dc5-5f0f-bf1f-2bd6a1cc4a8d"
		date = "2025-02-20"
		modified = "2025-03-20"
		reference = "https://any.run/cybersecurity-blog/cyber-attacks-january-2025/#fake-youtube-links-redirect-users-to-phishing-pages-11298"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/susp_email_redirection_spoofing.yar#L1-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "9b196220b369c199a7e4d57cb5db18b32eb2565a6f9190929c5c01ac4fa04ac8"
		hash = "c4eb35c1a1c10226bff9bb0c88ca516441208d193b4994eeb292a66e53a2cc04"
		hash = "e3b8ea03a472348814c6ac81088234836e627a1878ec36e46ce62526e1390935"
		logic_hash = "9a411317821751dc0873fe3163791115d1e19bc4d57119ed2ba513b444864032"
		score = 70
		quality = 85
		tags = ""

	strings:
		$sa1 = "Content-Transfer-Encoding:" ascii
		$sa2 = "Subject:" ascii
		$x = ".com%20%20%20%20%20%" ascii

	condition:
		all of them
}

Strings (3 patterns)

IdentifierTypeValueModifiers
$sa1text"Content-Transfer-Encoding:"ascii
$sa2text"Subject:"ascii
$xtext".com%20%20%20%20%20%"ascii

Condition

all of them

In plain words (Heuristic)

  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 9b196220b369c199a7e4d57cb5db18b32eb2565a6f9190929c5c01ac4fa04ac8
  • c4eb35c1a1c10226bff9bb0c88ca516441208d193b4994eeb292a66e53a2cc04
  • e3b8ea03a472348814c6ac81088234836e627a1878ec36e46ce62526e1390935

Licence & attribution

Author: Jonathan Peters (cod3nym)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: bf3a2b06-4dc5-5f0f-bf1f-2bd6a1cc4a8d

Related rules