detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: html

RuleSeverity
Body HTML: Comment with 24-character hex tokenlow
HTML content with print styling and credential theft languagehigh
HTML: Bidirectional (BIDI) HTML override with right to left obfuscationmedium
Potential prompt injection attack in body HTMLhigh

Body HTML: Comment with 24-character hex token

#
Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing HTML comments with exactly 24 hexadecimal characters, which may indicate tracking tokens, session identifiers, or other suspicious embedded data used for evasion or tracking purposes.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesSpam
Tactics and techniquesEvasion

Telemetry Coverage

PlatformRecord / event type
SublimeInbound email message

Message Attributes

  • body
  • body.current_thread
  • headers
  • headers.auth_summary
  • sender.email
  • type

Rule Body

type.inbound
and any(html.xpath(body.html, '//comment()').nodes,
        regex.imatch(.raw, '<!--\s*[a-f0-9]{24}\s*-->')
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft", "bec") and .confidence != 'low'
)

Detection Logic

Scope: inbound message.

Detects messages containing HTML comments with exactly 24 hexadecimal characters, which may indicate tracking tokens, session identifiers, or other suspicious embedded data used for evasion or tracking purposes.

  1. inbound message
  2. any(html.xpath(body.html, '//comment()').nodes, regex.imatch(.raw, '<!--\s*[a-f0-9]{24}\s*-->') )
  3. not:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • coalesce(headers.auth_summary.dmarc.pass, false)
  4. any(ml.nlu_classifier(body.current_thread.text).intents, .name in ("cred_theft", "bec") and .confidence != 'low' )

Inspects: body.current_thread.text, body.html, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: html.xpath, ml.nlu_classifier, regex.imatch. Reference lists: $high_trust_sender_root_domains.

Indicators Matched (3)

FieldMatchValue
regex.imatchregex<!--\s*[a-f0-9]{24}\s*-->
ml.nlu_classifier(body.current_thread.text).intents[].namemembercred_theft
ml.nlu_classifier(body.current_thread.text).intents[].namememberbec

Stages and Predicates

Stage 1: mql_rule

and
  not
    and
      headers.auth_summary.dmarc.pass eq "true"
      headers.auth_summary.dmarc.pass is_not_null
      sender.email.domain.root_domain macro "sender.email.domain.root_domain in high_trust_sender_root_domains"
  type.inbound eq "true"
   macro "any(html.xpath(body.html, '//comment()').nodes,\n        regex.imatch(.raw, '<!--\\s*[a-f0-9]{24}\\s*-->')\n)"
   macro "any(ml.nlu_classifier(body.current_thread.text).intents,\n        .name in (\"cred_theft\", \"bec\") and .confidence != 'low'\n)"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean corpus 1212 (mql 1212)
field:"type.inbound" kind:eq value:"true"

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
headers.auth_summary.dmarc.passeqtrueexcludes:headers.auth_summary.dmarc.pass field:"headers.auth_summary.dmarc.pass" value:"true"
headers.auth_summary.dmarc.passis_not_null(no value, null check)excludes:headers.auth_summary.dmarc.pass

HTML content with print styling and credential theft language

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing specific HTML print styling directives combined with high or medium confidence credential theft language, often used to format malicious content for printing or display.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, HTML smuggling, Social engineering

Telemetry Coverage

PlatformRecord / event type
SublimeInbound email message

Message Attributes

  • body
  • body.current_thread
  • body.html
  • type

Rule Body

type.inbound
and strings.icontains(body.html.raw,
                      '<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}'
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)

Detection Logic

Scope: inbound message.

Detects messages containing specific HTML print styling directives combined with high or medium confidence credential theft language, often used to format malicious content for printing or display.

  1. inbound message
  2. body.html.raw contains '<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}'
  3. any(ml.nlu_classifier(body.current_thread.text).intents, .name == 'cred_theft' and .confidence != 'low' )

Inspects: body.current_thread.text, body.html.raw, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.

Indicators Matched (2)

FieldMatchValue
strings.icontainssubstring<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft

Stages and Predicates

Stage 1: mql_rule

and
  body.html.raw contains "<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}"
  type.inbound eq "true"
   macro "any(ml.nlu_classifier(body.current_thread.text).intents,\n        .name == 'cred_theft' and .confidence != 'low'\n)"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
body.html.rawcontains
  • <style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}
field:"body.html.raw" kind:contains value:"<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}"
type.inboundeq
  • true transforms: boolean corpus 1212 (mql 1212)
field:"type.inbound" kind:eq value:"true"

HTML: Bidirectional (BIDI) HTML override with right to left obfuscation

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Body HTML contains multiple instances of right-to-left (RTL) text direction override markup, which can be used to visually manipulate text display and potentially bypass common strings checks.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesEvasion, Social engineering, Scripting

Telemetry Coverage

PlatformRecord / event type
SublimeInbound email message

Message Attributes

  • body
  • body.html
  • type

Rule Body

type.inbound
// You should only observe RTL injection when RTL languages are present.
and (
  regex.icount(body.html.raw, 'unicode-bidi\s*:\s*bidi-override[^>]*rtl') + regex.icount(body.html.raw,
                                                                                         '<bdo dir="rtl">'
  )
// Count allows for scalability for FP's.
) >= 3
// exclude legitimate CSS star-rating widgets
and not regex.icontains(body.html.raw, '\.rating[^}]*:hover')

Detection Logic

Scope: inbound message.

Body HTML contains multiple instances of right-to-left (RTL) text direction override markup, which can be used to visually manipulate text display and potentially bypass common strings checks.

  1. inbound message
  2. ( regex.icount(body.html.raw, 'unicode-bidi\s*:\s*bidi-override[^>]*rtl') + regex.icount(body.html.raw, '<bdo dir="rtl">' ) // Count allows for scalability for FP's. ) >= 3
  3. not:
    • body.html.raw matches '\\.rating[^}]*:hover'

Inspects: body.html.raw, type.inbound. Sensors: regex.icontains.

Stages and Predicates

Stage 1: mql_rule

and
  not
    body.html.raw regex_match "\\.rating[^}]*:hover"
  type.inbound eq "true"
   macro "(\n  regex.icount(body.html.raw, 'unicode-bidi\\s*:\\s*bidi-override[^>]*rtl') + regex.icount(body.html.raw,\n                                                                                         '<bdo dir=\"rtl\">'\n  )\n// Count allows for scalability for FP's.\n) >= 3"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean corpus 1212 (mql 1212)
field:"type.inbound" kind:eq value:"true"

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
body.html.rawregex_match.rating[^}]*:hoverexcludes:body.html.raw field:"body.html.raw" value:".rating[^}]*:hover"

Potential prompt injection attack in body HTML

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing references to major AI tools (like Gemini, Copilot, ChatGPT, or Claude) in non-standard HTML elements.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing, Credential Phishing, Extortion, Malware/Ransomware, Spam, BEC/Fraud
Tactics and techniquesEvasion, Social engineering

Telemetry Coverage

PlatformRecord / event type
SublimeInbound email message

Message Attributes

  • body
  • headers
  • headers.auth_summary
  • sender.email
  • type

Rule Body

type.inbound
and length(filter(html.xpath(body.html, "//*[local-name() = 'admin']").nodes,
                  length(.display_text) > 0
                  and strings.ilike(.display_text,
                                    '*gemini*',
                                    '*copilot*',
                                    '*chatgpt*',
                                    '*claude*'
                  )
           )
) > 0

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection Logic

Scope: inbound message.

Detects messages containing references to major AI tools (like Gemini, Copilot, ChatGPT, or Claude) in non-standard HTML elements.

  1. inbound message
  2. length(filter(html.xpath(body.html, "//*[local-name() = 'admin']").nodes, length(.display_text) > 0 and strings.ilike(.display_text, '*gemini*', '*copilot*', '*chatgpt*', '*claude*' ) ) ) > 0
  3. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.html, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: html.xpath, strings.ilike. Reference lists: $high_trust_sender_root_domains.

Indicators Matched (4)

FieldMatchValue
strings.ilikesubstring*gemini*
strings.ilikesubstring*copilot*
strings.ilikesubstring*chatgpt*
strings.ilikesubstring*claude*

Stages and Predicates

Stage 1: mql_rule

and
  or
    and
      not
        headers.auth_summary.dmarc.pass eq "true"
      sender.email.domain.root_domain macro "sender.email.domain.root_domain in high_trust_sender_root_domains"
    sender.email.domain.root_domain macro "sender.email.domain.root_domain not in high_trust_sender_root_domains"
  length func_call "length(filter(html.xpath(body.html, \"//*[local-name() = 'admin']\").nodes,\n                  length(.display_text) > 0\n                  and strings.ilike(.display_text,\n                                    '*gemini*',\n                                    '*copilot*',\n                                    '*chatgpt*',\n                                    '*claude*'\n                  )\n           )\n) > 0"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean corpus 1212 (mql 1212)
field:"type.inbound" kind:eq value:"true"

Back to all Sublime MQL rules