detection.wiki

Detection rules › Sublime MQL

HTML content with print styling and credential theft language

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing specific HTML print styling directives combined with high or medium confidence credential theft language, often used to format malicious content for printing or display.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, HTML smuggling, Social engineering

Event coverage

Message attribute
body.current_thread
body.html
type

Rule body MQL

type.inbound
and strings.icontains(body.html.raw,
                      '<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}'
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)

Detection logic

Scope: inbound message.

Detects messages containing specific HTML print styling directives combined with high or medium confidence credential theft language, often used to format malicious content for printing or display.

  1. inbound message
  2. body.html.raw contains '<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}'
  3. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    • .name is 'cred_theft'
    • .confidence is not 'low'

Inspects: body.current_thread.text, body.html.raw, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.

Indicators matched (2)

FieldMatchValue
strings.icontainssubstring<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft