Detection rules › Sublime MQL

Link: Credential theft with invisible Unicode character in page title from unsolicited sender

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing credential theft language and links to pages with invisible Unicode characters in the title tag, a technique commonly used to evade detection in fraudulent pages.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
// single recipient
and length(recipients.to) == 1
// valid recipient domain
and recipients.to[0].email.domain.valid
// between 1 and 14 links in the email
and 0 < length(body.links) < 15
// length of current thread is under 11k
and length(body.current_thread.text) < 11000
// tycoon captchas often have a page title with a specific unicode invisible char
and any(body.links,
        strings.contains(ml.link_analysis(., mode="aggressive").final_dom.raw,
                         "<title>\u{200B}</title>"
        )
        and length(ml.link_analysis(., mode="aggressive").final_dom.raw) < 10000
)
// unsolicited message
and not profile.by_sender().solicited

Detection logic

Scope: inbound message.

Detects messages containing credential theft language and links to pages with invisible Unicode characters in the title tag, a technique commonly used to evade detection in fraudulent pages.

  1. inbound message
  2. length(recipients.to) is 1
  3. recipients.to[0].email.domain.valid
  4. all of:
    • length(body.links) > 0
    • length(body.links) < 15
  5. length(body.current_thread.text) < 11000
  6. any of body.links where all hold:
    • ml.link_analysis(., mode='aggressive').final_dom.raw contains '<title>\\u{200B}</title>'
    • length(ml.link_analysis(., mode='aggressive').final_dom.raw) < 10000
  7. not:
    • profile.by_sender().solicited

Inspects: body.current_thread.text, body.links, recipients.to, recipients.to[0].email.domain.valid, type.inbound. Sensors: ml.link_analysis, profile.by_sender, strings.contains.

Indicators matched (1)

FieldMatchValue
strings.containssubstring<title>\u{200B}</title>