Detection rules › Sublime MQL

Credential theft: Gophish abuse with hidden tracking image

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing hidden tracking images with display:none style and tracking parameters in the source URL, commonly used for user tracking and engagement monitoring.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesSpam
Tactics and techniquesEvasion, Image as content

Event coverage

Message attribute
body.html
type

Rule body MQL

type.inbound
and (
  strings.icontains(body.html.raw,
                    '<img alt='''' style=''display: none'' src='''
  )
  or strings.icontains(body.html.raw, 'img alt="" style="display: none" src="')
)
and strings.icontains(body.html.raw, '/track?rid=')

Detection logic

Scope: inbound message.

Detects messages containing hidden tracking images with display:none style and tracking parameters in the source URL, commonly used for user tracking and engagement monitoring.

  1. inbound message
  2. any of:
    • body.html.raw contains "<img alt='' style='display: none' src='"
    • body.html.raw contains 'img alt="" style="display: none" src="'
  3. body.html.raw contains '/track?rid='

Inspects: body.html.raw, type.inbound. Sensors: strings.icontains.

Indicators matched (3)

FieldMatchValue
strings.icontainssubstring<img alt='' style='display: none' src='
strings.icontainssubstringimg alt="" style="display: none" src="
strings.icontainssubstring/track?rid=