Detection rules › Sublime MQL
Credential theft: Gophish abuse with hidden tracking image
Detects messages containing hidden tracking images with display:none style and tracking parameters in the source URL, commonly used for user tracking and engagement monitoring.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Evasion, Image as content |
Event coverage
Rule body MQL
type.inbound
and (
strings.icontains(body.html.raw,
'<img alt='''' style=''display: none'' src='''
)
or strings.icontains(body.html.raw, 'img alt="" style="display: none" src="')
)
and strings.icontains(body.html.raw, '/track?rid=')
Detection logic
Scope: inbound message.
Detects messages containing hidden tracking images with display:none style and tracking parameters in the source URL, commonly used for user tracking and engagement monitoring.
- inbound message
any of:
- body.html.raw contains "<img alt='' style='display: none' src='"
- body.html.raw contains 'img alt="" style="display: none" src="'
- body.html.raw contains '/track?rid='
Inspects: body.html.raw, type.inbound. Sensors: strings.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | <img alt='' style='display: none' src=' |
strings.icontains | substring | img alt="" style="display: none" src=" |
strings.icontains | substring | /track?rid= |