sublimelowRule

Body: Yellow highlighted text markers

Detects messages containing multiple HTML span elements with yellow background highlighting (rgb(255, 241, 0)) and data-markjs attributes, potentially indicating evasion techniques through visual markup manipulation.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1036 T1027

defense-evasion

Detection Query

type.inbound
and regex.icount(body.html.raw,
                 '<span[^>]*data-markjs="true"[^>]*background-color:\s*rgb\(255,\s*241,\s*0\)[^>]*>[^<]'
) >= 2

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Body: Yellow highlighted text markers"
description: "Detects messages containing multiple HTML span elements with yellow background highlighting (rgb(255, 241, 0)) and data-markjs attributes, potentially indicating evasion techniques through visual markup manipulation."
type: "rule"
severity: "low"
source: |
  type.inbound
  and regex.icount(body.html.raw,
                   '<span[^>]*data-markjs="true"[^>]*background-color:\s*rgb\(255,\s*241,\s*0\)[^>]*>[^<]'
  ) >= 2
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "HTML analysis"
  - "Content analysis"
id: "869dd39d-02a5-59f2-8fa9-3922a8fd5467"