This rule detects inbound messages containing links that use a base64-encoded payload in the URL path. It restricts to messages with 1–3 links to limit noise. The detection looks for href_url.path patterns matching '/[a-z]{1,3}/([A-Za-z0-9+/=_-]{20,})', where the trailing segment is a base64-encoded string. It then decodes the payload (base64, ignore padding) and checks for two potential indicators of a hidden redirect: (1) a "u" parameter containing a destination URL (e.g., "u":"https://...") within the decoded content, and (2) parsing the decoded string as a URL and verifying whether its root domain appears in a configured URL-shortener allowlist. If either condition is satisfied, the rule flags the message as suspicious. This approach targets obfuscated redirects commonly used in credential phishing to conceal the final destination. It combines URL analysis (parsing path components, query parameters, and host/domain checks) with content analysis (examining the decoded payload for embedded URLs). The tactic covers Open Redirect and evasion of simple filters by employing base64 encoding to obscure the final URL. The rule is rated medium severity, reflecting that while it detects a suspect phishing pattern, legitimate services may occasionally use similar obfuscation. To reduce false positives, consider maintaining a current allowlist for known safe shorteners and correlating with additional indicators (e.g., user context, reputation, or historical sender behavior). Forensic value is enhanced by logging decoded payloads where safe, and by cross-referencing with other phishing controls. In deployment, monitor inbound messages with multiple links and obfuscated destinations as a notable risk vector requiring user awareness and potential remediation actions.