sublimehighRule

Link: URL fragmented by hidden spans

Detects messages containing HTML links that are broken up with inline <span> elements styled with display:none, injecting random alphanumeric strings inside the URL to defeat text-based scanning while rendering strings that looks like a link to the recipient. Observed lures impersonate HR or payroll communications, such as fake 401K enrollment notices and PTO balance alerts, sent from unrelated or spoofed domains to drive clicks on the obfuscated link.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and strings.icontains(body.html.raw, 'https:/<span')
and regex.icontains(body.html.raw,
                    'https:/<span[^>]{0,300}display:\s*none[^>]{0,300}>[A-Z0-9]{6,}\s*</span>/'
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: URL fragmented by hidden spans"
description: "Detects messages containing HTML links that are broken up with inline <span> elements styled with display:none, injecting random alphanumeric strings inside the URL to defeat text-based scanning while rendering strings that looks like a link to the recipient. Observed lures impersonate HR or payroll communications, such as fake 401K enrollment notices and PTO balance alerts, sent from unrelated or spoofed domains to drive clicks on the obfuscated link."
type: "rule"
severity: "high"
source: |
  type.inbound
  and strings.icontains(body.html.raw, 'https:/<span')
  and regex.icontains(body.html.raw,
                      'https:/<span[^>]{0,300}display:\s*none[^>]{0,300}>[A-Z0-9]{6,}\s*</span>/'
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "HTML analysis"
  - "Content analysis"
  - "URL analysis"
id: "9c7f6db1-2e4e-50db-ab74-eaa29822189e"