detection.wiki

Detection rules › Sublime MQL

Body: Yellow highlighted text markers

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing multiple HTML span elements with yellow background highlighting (rgb(255, 241, 0)) and data-markjs attributes, potentially indicating evasion techniques through visual markup manipulation.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, BEC/Fraud
Tactics and techniquesEvasion

Event coverage

Message attribute
body.html
type

Rule body MQL

type.inbound
and regex.icount(body.html.raw,
                 '<span[^>]*data-markjs="true"[^>]*background-color:\s*rgb\(255,\s*241,\s*0\)[^>]*>[^<]'
) >= 2

Detection logic

Scope: inbound message.

Detects messages containing multiple HTML span elements with yellow background highlighting (rgb(255, 241, 0)) and data-markjs attributes, potentially indicating evasion techniques through visual markup manipulation.

  1. inbound message
  2. regex.icount(body.html.raw, '<span[^>]*data-markjs="true"[^>]*background-color:\\s*rgb\\(255,\\s*241,\\s*0\\)[^>]*>[^<]') ≥ 2

Inspects: body.html.raw, type.inbound. Sensors: regex.icount.

Indicators matched (1)

FieldMatchValue
regex.icountregex<span[^>]*data-markjs="true"[^>]*background-color:\s*rgb\(255,\s*241,\s*0\)[^>]*>[^<]