Detection rules › Sublime MQL

Sublime MQL rules: gophish

Rule	Severity
Credential theft: Gophish abuse with hidden tracking image	`high`

Credential theft: Gophish abuse with hidden tracking image

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages containing hidden tracking images with display:none style and tracking parameters in the source URL, commonly used for user tracking and engagement monitoring.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Spam
Tactics and techniques	Evasion, Image as content

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.html
type

Rule body

type.inbound
and (
  strings.icontains(body.html.raw,
                    '<img alt='''' style=''display: none'' src='''
  )
  or strings.icontains(body.html.raw, 'img alt="" style="display: none" src="')
)
and strings.icontains(body.html.raw, '/track?rid=')

Detection logic

Scope: inbound message.

Detects messages containing hidden tracking images with display:none style and tracking parameters in the source URL, commonly used for user tracking and engagement monitoring.

inbound message
any of:
- body.html.raw contains "<img alt='' style='display: none' src='"
- body.html.raw contains 'img alt="" style="display: none" src="'
body.html.raw contains '/track?rid='

Inspects: body.html.raw, type.inbound. Sensors: strings.icontains.

Indicators matched (3)

Field	Match	Value
`strings.icontains`	substring	`<img alt='' style='display: none' src='`
`strings.icontains`	substring	`img alt="" style="display: none" src="`
`strings.icontains`	substring	`/track?rid=`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    body.html.raw contains "<img alt='' style='display: none' src='"
    body.html.raw contains "img alt=\"\" style=\"display: none\" src=\""
  body.html.raw contains "/track?rid="
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.html.raw`	contains	`/track?rid=` `<img alt='' style='display: none' src='` `img alt="" style="display: none" src="`	`field:"body.html.raw" kind:contains`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`