Detects inbound messages where the visible text/body is near-empty, yet the HTML references four or more embedded images that share the same content-ID base hash (CID) and differ only by a numeric index. This fingerprint indicates an image tiled across HTML (often via a table layout) to evade text and URL scanning while rendering as a single image to the recipient. The rule looks for a CID pattern cid:([a-f0-9]{16,})\.
{1,3}@ in body.html.raw and counts how many img src references correspond to that base hash. If four or more images match, it triggers. This is a common evasion technique used in credential phishing and callback phishing campaigns that relies on image-based content and social engineering. The rule uses HTML analysis and content analysis to detect such evasion.**