Detection rules › Sublime MQL
Link: Credential theft with invisible Unicode character in page title from unsolicited sender
Detects messages containing credential theft language and links to pages with invisible Unicode characters in the title tag, a technique commonly used to evade detection in fraudulent pages.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
// single recipient
and length(recipients.to) == 1
// valid recipient domain
and recipients.to[0].email.domain.valid
// between 1 and 14 links in the email
and 0 < length(body.links) < 15
// length of current thread is under 11k
and length(body.current_thread.text) < 11000
// tycoon captchas often have a page title with a specific unicode invisible char
and any(body.links,
strings.contains(ml.link_analysis(., mode="aggressive").final_dom.raw,
"<title>\u{200B}</title>"
)
and length(ml.link_analysis(., mode="aggressive").final_dom.raw) < 10000
)
// unsolicited message
and not profile.by_sender().solicited
Detection logic
Scope: inbound message.
Detects messages containing credential theft language and links to pages with invisible Unicode characters in the title tag, a technique commonly used to evade detection in fraudulent pages.
- inbound message
- length(recipients.to) is 1
- recipients.to[0].email.domain.valid
all of:
- length(body.links) > 0
- length(body.links) < 15
- length(body.current_thread.text) < 11000
any of
body.linkswhere all hold:- ml.link_analysis(., mode='aggressive').final_dom.raw contains '<title>\\u{200B}</title>'
- length(ml.link_analysis(., mode='aggressive').final_dom.raw) < 10000
not:
- profile.by_sender().solicited
Inspects: body.current_thread.text, body.links, recipients.to, recipients.to[0].email.domain.valid, type.inbound. Sensors: ml.link_analysis, profile.by_sender, strings.contains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.contains | substring | <title>\u{200B}</title> |