sublimemediumRule

Link: Fake secure message notification template

Detects inbound messages containing links that match a specific HTML styling fingerprint characterized by a distinctive blue color scheme (rgb(41, 88, 140)), a bottom border of 10px solid with the same blue, and a padding of 1.6em. This combination of CSS properties is associated with malicious messages designed to lure recipients into clicking embedded links.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and length(body.links) > 0
and regex.icontains(body.html.raw,
                    'background-color\s*:\s*rgb\(41,\s*88,\s*140\)'
)
and regex.icontains(body.html.raw,
                    'border-bottom\s*:\s*10px\s+solid\s+rgb\(41,\s*88,\s*140\)'
)
and regex.icontains(body.html.raw, 'padding\s*:\s*1\.6em')

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Fake secure message notification template"
description: "Detects inbound messages containing links that match a specific HTML styling fingerprint characterized by a distinctive blue color scheme (rgb(41, 88, 140)), a bottom border of 10px solid with the same blue, and a padding of 1.6em. This combination of CSS properties is associated with malicious messages designed to lure recipients into clicking embedded links."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and length(body.links) > 0
  and regex.icontains(body.html.raw,
                      'background-color\s*:\s*rgb\(41,\s*88,\s*140\)'
  )
  and regex.icontains(body.html.raw,
                      'border-bottom\s*:\s*10px\s+solid\s+rgb\(41,\s*88,\s*140\)'
  )
  and regex.icontains(body.html.raw, 'padding\s*:\s*1\.6em')
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "HTML analysis"
  - "Content analysis"
  - "URL analysis"
id: "41148d75-676a-5ce6-aeb3-91cf943c3efd"