detection.wiki

Detection rules › Sublime MQL

Brand impersonation: Zoom via HTML styling

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages impersonating Zoom by identifying HTML table cells with specific blue styling (rgb(11,92,255)) containing Zoom branding in header elements.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
body
type

Rule body MQL

type.inbound
and any(html.xpath(body.html, '//tr/td[contains(@style, "rgb(11,92,255)")]/h1').nodes,
        strings.icontains(.display_text, "zoom")
)

Detection logic

Scope: inbound message.

Detects messages impersonating Zoom by identifying HTML table cells with specific blue styling (rgb(11,92,255)) containing Zoom branding in header elements.

  1. inbound message
  2. any of html.xpath(body.html, '//tr/td[contains(@style, "rgb(11,92,255)")]/h1').nodes where:
    • .display_text contains 'zoom'

Inspects: body.html, type.inbound. Sensors: html.xpath, strings.icontains.

Indicators matched (1)

FieldMatchValue
strings.icontainssubstringzoom