sublimemediumRule

Body: CSS clamp() font obfuscation

Detects inbound messages where the HTML body (including HTML content within .eml attachments) uses CSS clamp() with a font-size or line-height minimum bound of zero or a negative value. This technique renders text invisible or unreadable to recipients while remaining present in the underlying markup, a method commonly used to hide malicious content or evade text-based detection engines.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and (
  (
    regex.icontains(body.html.raw,
                    '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
    )
  )
  or any(attachments,
         (.content_type == "message/rfc822" or .file_extension =~ "eml")
         and regex.icontains(file.parse_eml(.).body.html.raw,
                             '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
         )
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Body: CSS clamp() font obfuscation"
description: "Detects inbound messages where the HTML body (including HTML content within .eml attachments) uses CSS clamp() with a font-size or line-height minimum bound of zero or a negative value. This technique renders text invisible or unreadable to recipients while remaining present in the underlying markup, a method commonly used to hide malicious content or evade text-based detection engines."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    (
      regex.icontains(body.html.raw,
                      '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
      )
    )
    or any(attachments,
           (.content_type == "message/rfc822" or .file_extension =~ "eml")
           and regex.icontains(file.parse_eml(.).body.html.raw,
                               '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
           )
    )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "HTML analysis"
  - "URL analysis"
  - "Content analysis"
id: "0eaf1193-22e2-5cc2-845c-4f8f26b48ab2"