This rule detects inbound messages containing hyperlinks whose subdomain matches a pattern indicative of auto-generated or algorithmically created hosting infrastructure often used to evade detection. Specifically, it looks for a subdomain that comprises 3–30 lowercase letters followed by a 32-character hexadecimal string (regex: [a-z]{3,30}[0-9a-f]{32}). The presence of such a subdomain within a link (as evaluated from href_url.domain.subdomain in the current thread's links) triggers a detection with medium severity. The rule is categorized under Credential Phishing and evasion techniques, leveraging URL analysis as the primary detection method. Rationale: adversaries often use DGAs or autogenerated hosting subdomains to disguise phishing pages and bypass simple URL allowlists. Considerations for false positives include legitimate services or content delivery networks that occasionally use random-looking subdomains, or legitimate MD5/hex-based identifiers in subdomains. To reduce noise, correlate with additional indicators (sender reputation, domain reputation, message subject/attachments, geographic patterns, and prevalence across campaigns). Recommended actions include quarantining or flagging the message for user awareness and further investigation, and/or applying additional context-based filters (e.g., known-good subdomains, reputation checks).