detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: html

RuleSeverity
Body HTML: Comment with 24-character hex tokenlow
HTML content with print styling and credential theft languagehigh
HTML: Bidirectional (BIDI) HTML override with right to left obfuscationmedium
Potential prompt injection attack in body HTMLhigh

Body HTML: Comment with 24-character hex token

#
Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing HTML comments with exactly 24 hexadecimal characters, which may indicate tracking tokens, session identifiers, or other suspicious embedded data used for evasion or tracking purposes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesSpam
Tactics and techniquesEvasion

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • body
  • body.html
  • type

Rule body

type.inbound
and (
  // 24-character hex token is the very first thing in HTML
  regex.icontains(body.html.raw, '^\s*<!--\s*[a-f0-9]{24}\s*-->')
  // exactly one comment and it's the hex token
  or (
    // hex is anywhere in html with no mso 
    any(html.xpath(body.html, '//comment()').nodes,
        regex.icontains(.raw, '^<!--\s*[a-f0-9]{24}\s*-->$')
    )
    and not any(html.xpath(body.html, '//comment()').nodes,
                strings.icontains(.raw, '[if')
    )
  )
)

Detection logic

Scope: inbound message.

Detects messages containing HTML comments with exactly 24 hexadecimal characters, which may indicate tracking tokens, session identifiers, or other suspicious embedded data used for evasion or tracking purposes.

  1. inbound message
  2. any of:
    • body.html.raw matches '^\\s*<!--\\s*[a-f0-9]{24}\\s*-->'
    • all of:
      • any of html.xpath(body.html, '//comment()').nodes where:
        • .raw matches '^<!--\\s*[a-f0-9]{24}\\s*-->$'
      • not:
        • any of html.xpath(body.html, '//comment()').nodes where:
          • .raw contains '[if'

Inspects: body.html, body.html.raw, type.inbound. Sensors: html.xpath, regex.icontains, strings.icontains.

Indicators matched (2)

FieldMatchValue
regex.icontainsregex^\s*<!--\s*[a-f0-9]{24}\s*-->
regex.icontainsregex^<!--\s*[a-f0-9]{24}\s*-->$

Stages and Predicates

Stage 1: mql_rule

and
  or
    and
      not
        any(html.xpath(body.html, '//comment()').nodes)
          html.xpath(body.html, '//comment()').nodes.raw contains "[if"
      any(html.xpath(body.html, '//comment()').nodes)
        html.xpath(body.html, '//comment()').nodes.raw regex_match "^<!--\\s*[a-f0-9]{24}\\s*-->$"
    body.html.raw regex_match "^\\s*<!--\\s*[a-f0-9]{24}\\s*-->"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
body.html.rawregex_match
  • ^\s*<!--\s*[a-f0-9]{24}\s*-->
field:"body.html.raw" kind:regex_match value:"^\s*<!--\s*[a-f0-9]{24}\s*-->"
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"

HTML content with print styling and credential theft language

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing specific HTML print styling directives combined with high or medium confidence credential theft language, often used to format malicious content for printing or display.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, HTML smuggling, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • body
  • body.current_thread
  • body.html
  • type

Rule body

type.inbound
and strings.icontains(body.html.raw,
                      '<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}'
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)

Detection logic

Scope: inbound message.

Detects messages containing specific HTML print styling directives combined with high or medium confidence credential theft language, often used to format malicious content for printing or display.

  1. inbound message
  2. body.html.raw contains '<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}'
  3. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    • .name is 'cred_theft'
    • .confidence is not 'low'

Inspects: body.current_thread.text, body.html.raw, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.

Indicators matched (2)

FieldMatchValue
strings.icontainssubstring<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft

Stages and Predicates

Stage 1: mql_rule

and
  any(ml.nlu_classifier(body.current_thread.text).intents)
    and
      ml.nlu_classifier(body.current_thread.text).intents.confidence ne "low"
      ml.nlu_classifier(body.current_thread.text).intents.name eq "cred_theft"
  body.html.raw contains "<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
body.html.rawcontains
  • <style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}
field:"body.html.raw" kind:contains value:"<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}"
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"

HTML: Bidirectional (BIDI) HTML override with right to left obfuscation

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Body HTML contains multiple instances of right-to-left (RTL) text direction override markup, which can be used to visually manipulate text display and potentially bypass common strings checks.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesEvasion, Social engineering, Scripting

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • type

Rule body

type.inbound
// You should only observe RTL injection when RTL languages are present.
and (
  regex.icount(body.html.raw,
               '<span style="unicode-bidi: bidi-override; display: inline-block;" dir="rtl">'
  ) + regex.icount(body.html.raw, '<bdo dir="rtl">')
// Count allows for scalability for FP's.
) >= 3

Detection logic

Scope: inbound message.

Body HTML contains multiple instances of right-to-left (RTL) text direction override markup, which can be used to visually manipulate text display and potentially bypass common strings checks.

  1. inbound message
  2. regex.icount(body.html.raw) + regex.icount(body.html.raw) ≥ 3

Inspects: type.inbound.

Stages and Predicates

Stage 1: mql_rule

and
  type.inbound eq "true"
   macro "(regex.icount(body.html.raw) + regex.icount(body.html.raw)) >= 3"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"

Potential prompt injection attack in body HTML

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing references to major AI tools (like Gemini, Copilot, ChatGPT, or Claude) in non-standard HTML elements.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing, Credential Phishing, Extortion, Malware/Ransomware, Spam, BEC/Fraud
Tactics and techniquesEvasion, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • body
  • headers
  • headers.auth_summary
  • sender.email
  • type

Rule body

type.inbound
and length(filter(html.xpath(body.html, "//*[local-name() = 'admin']").nodes,
                  length(.display_text) > 0
                  and strings.ilike(.display_text,
                                    '*gemini*',
                                    '*copilot*',
                                    '*chatgpt*',
                                    '*claude*'
                  )
           )
) > 0

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Detects messages containing references to major AI tools (like Gemini, Copilot, ChatGPT, or Claude) in non-standard HTML elements.

  1. inbound message
  2. length(filter(html.xpath(body.html, "//*[local-name() = 'admin']").nodes, length(.display_text) > 0 and strings.ilike(.display_text, '*gemini*', '*copilot*', '*chatgpt*', '*claude*'))) > 0
  3. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.html, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: html.xpath, strings.ilike. Reference lists: $high_trust_sender_root_domains.

Indicators matched (4)

FieldMatchValue
strings.ilikesubstring*gemini*
strings.ilikesubstring*copilot*
strings.ilikesubstring*chatgpt*
strings.ilikesubstring*claude*

Stages and Predicates

Stage 1: mql_rule

and
  or
    and
      not
        headers.auth_summary.dmarc.pass eq "true"
       macro "sender.email.domain.root_domain in high_trust_sender_root_domains"
     macro "sender.email.domain.root_domain not in high_trust_sender_root_domains"
  filter(html.xpath(body.html, "//*[local-name() = 'admin']").nodes, length(.display_text) > 0 and strings.ilike(.display_text, '*gemini*', '*copilot*', '*chatgpt*', '*claude*')) length_compare "0"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"