heroui logo

Body: Suspicious table template fingerprint

Sublime Rules

View Source
Summary
Detects inbound messages containing a specific HTML table-based fingerprint used in credential phishing campaigns. The rule targets a table structure within the HTML body that contains both the text nodes "Important" and "Company". It leverages XPath-based HTML analysis to inspect table cells, specifically those with a background-color style, and checks for the presence of the two indicative text nodes. When a match is found, the rule flags potential credential phishing attempts that rely on a templated, deceptive message designed to resemble legitimate communications. This fingerprint corresponds to a known malicious template and is categorized under social engineering and evasion techniques, supported by HTML/content analysis detections. The approach helps reduce user cred-taking risk by catching crafted HTML emails before credential prompts are presented to recipients.
Categories
  • Network
  • Endpoint
  • Web
  • Application
Data Sources
  • Network Traffic
  • File
Created: 2026-06-26