
Summary
Detects inbound messages containing a specific HTML table-based fingerprint used in credential phishing campaigns. The rule targets a table structure within the HTML body that contains both the text nodes "Important" and "Company". It leverages XPath-based HTML analysis to inspect table cells, specifically those with a background-color style, and checks for the presence of the two indicative text nodes. When a match is found, the rule flags potential credential phishing attempts that rely on a templated, deceptive message designed to resemble legitimate communications. This fingerprint corresponds to a known malicious template and is categorized under social engineering and evasion techniques, supported by HTML/content analysis detections. The approach helps reduce user cred-taking risk by catching crafted HTML emails before credential prompts are presented to recipients.
Categories
- Network
- Endpoint
- Web
- Application
Data Sources
- Network Traffic
- File
Created: 2026-06-26