sublimemediumRule

Body: CSS clamp() font obfuscation with suspicious URL

Detects inbound messages where the HTML body, or an embedded .eml attachment, contains CSS using the clamp() function with a negative or zero font-size/line-height value—a technique used to hide or obscure text from readers or automated scanners—combined with a link whose URL contains an IP address or an embedded username, both common indicators of an obfuscated or malicious destination.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and (
  (
    regex.icontains(body.html.raw,
                    '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
    )
    and any(body.links,
            .href_url.ip.ip is not null or .href_url.username is not null
    )
  )
  or any(attachments,
         (.content_type == "message/rfc822" or .file_extension =~ "eml")
         and regex.icontains(file.parse_eml(.).body.html.raw,
                             '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
         )
         and any(file.parse_eml(.).body.links,
                 .href_url.ip.ip is not null or .href_url.username is not null
         )
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Body: CSS clamp() font obfuscation with suspicious URL"
description: "Detects inbound messages where the HTML body, or an embedded .eml attachment, contains CSS using the clamp() function with a negative or zero font-size/line-height value—a technique used to hide or obscure text from readers or automated scanners—combined with a link whose URL contains an IP address or an embedded username, both common indicators of an obfuscated or malicious destination."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    (
      regex.icontains(body.html.raw,
                      '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
      )
      and any(body.links,
              .href_url.ip.ip is not null or .href_url.username is not null
      )
    )
    or any(attachments,
           (.content_type == "message/rfc822" or .file_extension =~ "eml")
           and regex.icontains(file.parse_eml(.).body.html.raw,
                               '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
           )
           and any(file.parse_eml(.).body.links,
                   .href_url.ip.ip is not null or .href_url.username is not null
           )
    )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "HTML analysis"
  - "URL analysis"
  - "Content analysis"
id: "0eaf1193-22e2-5cc2-845c-4f8f26b48ab2"