detection.wiki

Detection rules › Sublime MQL

HTML: Bidirectional (BIDI) HTML override with right to left obfuscation

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Body HTML contains multiple instances of right-to-left (RTL) text direction override markup, which can be used to visually manipulate text display and potentially bypass common strings checks.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesEvasion, Social engineering, Scripting

Event coverage

Message attribute
type

Rule body MQL

type.inbound
// You should only observe RTL injection when RTL languages are present.
and (
  regex.icount(body.html.raw,
               '<span style="unicode-bidi: bidi-override; display: inline-block;" dir="rtl">'
  ) + regex.icount(body.html.raw, '<bdo dir="rtl">')
// Count allows for scalability for FP's.
) >= 3

Detection logic

Scope: inbound message.

Body HTML contains multiple instances of right-to-left (RTL) text direction override markup, which can be used to visually manipulate text display and potentially bypass common strings checks.

  1. inbound message
  2. regex.icount(body.html.raw) + regex.icount(body.html.raw) ≥ 3

Inspects: type.inbound.