sublimemediumRule

Body: CSS Hidden text via clip-path

Detects inbound messages containing a div styled with 'clip-path: inset(100%)', a CSS technique used to visually hide substantial blocks of text (over 150 characters) from the recipient while keeping it present in the underlying HTML. This method is commonly used to evade content-based detection engines by hiding filler or unrelated text within the message body.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(html.xpath(body.html, '//div[contains(@style,"clip-path")]').nodes,
        regex.icontains(.raw, 'clip-path:\s*inset\(\s*100%')
        and length(.inner_text) > 150
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Body: CSS Hidden text via clip-path"
description: "Detects inbound messages containing a div styled with 'clip-path: inset(100%)', a CSS technique used to visually hide substantial blocks of text (over 150 characters) from the recipient while keeping it present in the underlying HTML. This method is commonly used to evade content-based detection engines by hiding filler or unrelated text within the message body."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(html.xpath(body.html, '//div[contains(@style,"clip-path")]').nodes,
          regex.icontains(.raw, 'clip-path:\s*inset\(\s*100%')
          and length(.inner_text) > 150
  )
attack_types:
  - "Spam"
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "HTML analysis"
  - "Content analysis"
id: "ca09550e-7f33-535c-a178-3455faa5143b"