sublimehighRule

Body: Fake secure email portal with HTML obfuscation

Detects inbound messages with empty subjects impersonating a secure email portal, identified through multiple indicators including hidden HTML characters used to obfuscate the sender address, recipient domain echoed back as a portal sender, template typos, or frozen tracking links associated with known secure messaging infrastructure abuse.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and subject.base == ""
and strings.icontains(body.current_thread.text, "Secure Emails")
and strings.icontains(body.current_thread.text, "Title:")
and (
  // hidden-@ HTML obfuscation
  regex.icontains(body.html.raw, '<font[^>]+display\s*:\s*none[^>]*>@</font>')
  // recipient root domain echoed back as a portal sender
  or any(recipients.to,
         strings.icontains(body.current_thread.text,
                           strings.concat("acts@", .email.domain.root_domain)
         )
  )
  // template typo
  or strings.icontains(body.current_thread.text, "commuication portal")
  // frozen crId or linkprotect.cudasvc.com inner target
  or any(body.links,
         .href_url.domain.domain == "links.us1.defend.egress.com"
         and (
           strings.icontains(.href_url.query_params,
                             "crId=6a17340ad2523c97775fed21"
           )
           or strings.icontains(.href_url.query_params,
                                "OriginalLink=linkprotect.cudasvc.com"
           )
         )
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Body: Fake secure email portal with HTML obfuscation"
description: "Detects inbound messages with empty subjects impersonating a secure email portal, identified through multiple indicators including hidden HTML characters used to obfuscate the sender address, recipient domain echoed back as a portal sender, template typos, or frozen tracking links associated with known secure messaging infrastructure abuse."
type: "rule"
severity: "high"
source: |
  type.inbound
  and subject.base == ""
  and strings.icontains(body.current_thread.text, "Secure Emails")
  and strings.icontains(body.current_thread.text, "Title:")
  and (
    // hidden-@ HTML obfuscation
    regex.icontains(body.html.raw, '<font[^>]+display\s*:\s*none[^>]*>@</font>')
    // recipient root domain echoed back as a portal sender
    or any(recipients.to,
           strings.icontains(body.current_thread.text,
                             strings.concat("acts@", .email.domain.root_domain)
           )
    )
    // template typo
    or strings.icontains(body.current_thread.text, "commuication portal")
    // frozen crId or linkprotect.cudasvc.com inner target
    or any(body.links,
           .href_url.domain.domain == "links.us1.defend.egress.com"
           and (
             strings.icontains(.href_url.query_params,
                               "crId=6a17340ad2523c97775fed21"
             )
             or strings.icontains(.href_url.query_params,
                                  "OriginalLink=linkprotect.cudasvc.com"
             )
           )
    )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "Content analysis"
  - "HTML analysis"
  - "URL analysis"
  - "Sender analysis"
  - "Threat intelligence"
id: "a001584c-f940-516a-8ddf-d8b5be48f8b6"