Detection rules › Sublime MQL

Potential prompt injection attack in body HTML

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing references to major AI tools (like Gemini, Copilot, ChatGPT, or Claude) in non-standard HTML elements.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing, Credential Phishing, Extortion, Malware/Ransomware, Spam, BEC/Fraud
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
and length(filter(html.xpath(body.html, "//*[local-name() = 'admin']").nodes,
                  length(.display_text) > 0
                  and strings.ilike(.display_text,
                                    '*gemini*',
                                    '*copilot*',
                                    '*chatgpt*',
                                    '*claude*'
                  )
           )
) > 0

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Detects messages containing references to major AI tools (like Gemini, Copilot, ChatGPT, or Claude) in non-standard HTML elements.

  1. inbound message
  2. length(filter(html.xpath(body.html, "//*[local-name() = 'admin']").nodes, length(.display_text) > 0 and strings.ilike(.display_text, '*gemini*', '*copilot*', '*chatgpt*', '*claude*'))) > 0
  3. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.html, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: html.xpath, strings.ilike. Reference lists: $high_trust_sender_root_domains.

Indicators matched (4)

FieldMatchValue
strings.ilikesubstring*gemini*
strings.ilikesubstring*copilot*
strings.ilikesubstring*chatgpt*
strings.ilikesubstring*claude*