Body: CSS clamp() font obfuscation with suspicious URL

 1name: "Body: CSS clamp() font obfuscation with suspicious URL"
 2description: "Detects inbound messages where the HTML body, or an embedded .eml attachment, contains CSS using the clamp() function with a negative or zero font-size/line-height value—a technique used to hide or obscure text from readers or automated scanners—combined with a link whose URL contains an IP address or an embedded username, both common indicators of an obfuscated or malicious destination."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    (
 9      regex.icontains(body.html.raw,
10                      '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
11      )
12      and any(body.links,
13              .href_url.ip.ip is not null or .href_url.username is not null
14      )
15    )
16    or any(attachments,
17           (.content_type == "message/rfc822" or .file_extension =~ "eml")
18           and regex.icontains(file.parse_eml(.).body.html.raw,
19                               '(?:font-size|line-height):\s*clamp\s*\(\s*(?:-\d+|0)(?:px|em|rem|pt)?,'
20           )
21           and any(file.parse_eml(.).body.links,
22                   .href_url.ip.ip is not null or .href_url.username is not null
23           )
24    )
25  )  
26attack_types:
27  - "Credential Phishing"
28tactics_and_techniques:
29  - "Evasion"
30  - "Social engineering"
31detection_methods:
32  - "HTML analysis"
33  - "URL analysis"
34  - "Content analysis"
35id: "0eaf1193-22e2-5cc2-845c-4f8f26b48ab2"