Detection rules › Sublime MQL

Attachment: HTML with hidden body

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule identifies HTML attachments which begin directly with a hidden body element. This has been observed in phishing campaigns to hide the content of an otherwise benign HTML attachment that then has remote content injected into the body.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Scripting

Event coverage

Rule body MQL

type.inbound
and not profile.by_sender().solicited
// not high trust sender domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and any(attachments,
        .file_extension == "html"
        // starts with the hidden body element
        and regex.icontains(file.parse_html(.).raw,
                            '^<body style\s*=\s*"\s*display\s*:\s*none\s*;\s*">'
        )
)

Detection logic

Scope: inbound message.

This rule identifies HTML attachments which begin directly with a hidden body element. This has been observed in phishing campaigns to hide the content of an otherwise benign HTML attachment that then has remote content injected into the body.

  1. inbound message
  2. not:
    • profile.by_sender().solicited
  3. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains
  4. any of attachments where all hold:
    • .file_extension is 'html'
    • file.parse_html(.).raw matches '^<body style\\s*=\\s*"\\s*display\\s*:\\s*none\\s*;\\s*">'

Inspects: attachments[].file_extension, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.parse_html, profile.by_sender, regex.icontains. Reference lists: $high_trust_sender_root_domains.

Indicators matched (2)

FieldMatchValue
attachments[].file_extensionequalshtml
regex.icontainsregex^<body style\s*=\s*"\s*display\s*:\s*none\s*;\s*">