sublimehighRule

HTML content with print styling and credential theft language

Detects messages containing specific HTML print styling directives combined with high or medium confidence credential theft language, often used to format malicious content for printing or display.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and strings.icontains(body.html.raw,
                      '<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}'
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "HTML content with print styling and credential theft language"
description: "Detects messages containing specific HTML print styling directives combined with high or medium confidence credential theft language, often used to format malicious content for printing or display."
type: "rule"
severity: "high"
source: |
    type.inbound
    and strings.icontains(body.html.raw,
                          '<style>html {-webkit-print-color-adjust: exact} @media print {html, body {margin: 0; padding: 0; break-inside: avoid; page-break-inside: avoid}}'
    )
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == 'cred_theft' and .confidence != 'low'
    )

tags:
 - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "HTML smuggling"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "HTML analysis"
  - "Natural Language Understanding"
id: "c262f5ba-56e2-5715-978c-81abfd197126"