sublimehighRule

Attachment: Fake email body embedded in inline image

Catches messages with almost no visible body text and a single link, where an inline image doubles as both the message body and the link destination. The image is OCR'd and the extracted text is run through an NLU classifier to confirm credential-theft intent, matching lures such as fake voicemail transcripts, document-sharing notifications, and workflow addendum requests. Highly trusted sender domains that pass DMARC are excluded to reduce false positives.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and regex.icount(coalesce(body.current_thread.text, ""), '[a-z0-9]') < 15
and length(body.current_thread.links) == 1
and length(filter(attachments,
                  .content_disposition == "inline"
                  and .file_type in $file_types_images
                  and beta.ocr(.).success
                  and regex.icount(beta.ocr(.).text, '[a-zA-Z]{2,}') >= 20
           )
) == 1
and any(attachments,
        any(html.xpath(body.html, '//a[not(text())]//img/@src').nodes,
            strings.iends_with(.raw, ..content_id)
        )
        and beta.ocr(.).success
        and regex.icount(beta.ocr(.).text, '[a-zA-Z]{2,}') >= 20
        and any(ml.nlu_classifier(beta.ocr(.).text).intents,
                .name == "cred_theft"
        )
)
and any(body.current_thread.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Fake email body embedded in inline image"
description: "Catches messages with almost no visible body text and a single link, where an inline image doubles as both the message body and the link destination. The image is OCR'd and the extracted text is run through an NLU classifier to confirm credential-theft intent, matching lures such as fake voicemail transcripts, document-sharing notifications, and workflow addendum requests. Highly trusted sender domains that pass DMARC are excluded to reduce false positives."
type: "rule"
severity: "high"
source: |
  type.inbound
  and regex.icount(coalesce(body.current_thread.text, ""), '[a-z0-9]') < 15
  and length(body.current_thread.links) == 1
  and length(filter(attachments,
                    .content_disposition == "inline"
                    and .file_type in $file_types_images
                    and beta.ocr(.).success
                    and regex.icount(beta.ocr(.).text, '[a-zA-Z]{2,}') >= 20
             )
  ) == 1
  and any(attachments,
          any(html.xpath(body.html, '//a[not(text())]//img/@src').nodes,
              strings.iends_with(.raw, ..content_id)
          )
          and beta.ocr(.).success
          and regex.icount(beta.ocr(.).text, '[a-zA-Z]{2,}') >= 20
          and any(ml.nlu_classifier(beta.ocr(.).text).intents,
                  .name == "cred_theft"
          )
  )
  and any(body.current_thread.links,
          .href_url.domain.root_domain != sender.email.domain.root_domain
  )
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Image as content"
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "Optical Character Recognition"
  - "Natural Language Understanding"
  - "HTML analysis"
  - "Header analysis"
  - "Sender analysis"
id: "c2195370-692d-5287-b28a-fa8fa2c2cdc8"