Attackers hide destinations behind redirectors on reputable domains, and sometimes reuse links already wrapped by a security vendor so the message arrives looking pre-vetted. Reputation checks on the visible host pass. The durable approach unwraps nested URLs, follows the chain and scores the final destination.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| URL carrying another full URL in a redirect-style parameter (url=, redirect=, u=, q=, returnUrl=) | Gateway, proxy | T1566.002 |
| Open redirect on a reputable domain leading to a rare destination | Proxy, URL detonation | T1566.002 |
| Link already wrapped by a security vendor appearing in unsolicited mail | Gateway | T1566.002 |
| Redirect chains of three or more hops ending at a newly seen domain | URL detonation, proxy | T1204.001 |
| Same final domain reached through many different front domains | Proxy | T1583.001 |
Unwrapping Nested URLs
Extract the nested destination and judge that. This works whether the wrapper is a search engine redirect, a marketing tracker or a hijacked security rewrite service:
// Defender XDR (KQL) - nested destination inside redirect-style parameters EmailUrlInfo | where Timestamp > ago(7d) | where Url matches regex @"(?i)[?&](url|u|q|redirect|redirect_uri|return|returnurl|goto|dest|target)=https?" | extend Nested = extract(@"(?i)[?&](?:url|u|q|redirect|redirect_uri|return|returnurl|goto|dest|target)=(https?%3A%2F%2F[^&]+|https?://[^&]+)", 1, Url) | extend NestedDecoded = url_decode(Nested) | extend NestedHost = tostring(parse_url(NestedDecoded).Host) | where isnotempty(NestedHost) and NestedHost != UrlDomain | summarize msgs=dcount(NetworkMessageId) by UrlDomain, NestedHost | where msgs >= 2 | order by msgs desc // tune/validate: marketing and SSO flows redirect legitimately; allowlist known tracker domains
Chains and Final Hops
At the proxy or a detonation service, follow the redirect chain and compare the first host to the last. A short chain from a mailing platform is normal; a long chain that finishes on a rare domain with a login form is not:
index=proxy sourcetype=web earliest=-7d | rex field=url "(?i)[?&](?:url|u|redirect|redirect_uri|returnurl|goto|dest)=(?<nested>https?(?:%3A%2F%2F|://)[^&]+)" | where isnotnull(nested) | eval nested_host=lower(replace(urldecode(nested), "^https?://([^/:]+).*", "\1")) | stats dc(src_ip) as users count values(http_referrer) as refs by dest_host, nested_host | join type=left nested_host [ search index=proxy earliest=-30d | stats earliest(_time) as first_seen by dest_host | rename dest_host as nested_host ] | where users >= 2 AND first_seen > relative_time(now(), "-7d") # tune/validate: the join keys on first-seen time for the nested host; adjust to your own proxy field names.
- Block known open-redirect endpoints at the proxy and report them to the owning provider through its abuse channel.
- Do not treat a link already wrapped by your own or a partner vendor as safe by default; unwrap, then evaluate the inner URL.
- Detonate the final hop in a sandbox browser and look for credential forms on newly registered or low-reputation domains.
Use your email security vendor's URL-rewriting documentation, Microsoft Defender for Office URL and Safe Links guidance, SigmaHQ proxy rules and public lists of open-redirect behaviour as leads. Baseline your own environment — legitimate tracking and single sign-on redirects are everywhere.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts