This detection rule targets inbound messages that attempt to hide content using CSS styling tricks within HTML. Specifically, it looks for elements styled with display: table-column and with height: 0 or width: 0, which visually render as hidden in the message. The rule then checks that the hidden element contains more than 100 non-whitespace characters in its inner_text, indicating potentially substantial concealed payloads such as credentials, URLs, or other phishing content embedded in the DOM to evade text-based or visual detectors. The approach combines HTML analysis (to locate elements with the relevant style) and content analysis (to quantify hidden text). It is intended to mitigate evasion techniques used in credential phishing and spam campaigns by hiding information from human readers while keeping it accessible to automated parsers. If matched, the rule flags the inbound message for further inspection. Potential false positives may arise in legitimate scenarios where accessibility or styling legitimately hides content, so integration with contextual signals and user experience considerations is advised.