Body: CSS Hidden text via table-column

calendar Sep 3, 2026  ·
Share on: linkedin copy

Detects inbound messages containing elements styled with 'display: table-column' combined with a height or width of zero, effectively hiding the element from visual rendering. The rule flags cases where the hidden element contains more than 100 non-whitespace characters of inner text, a technique commonly used to conceal content from human recipients while still embedding it in the DOM to evade text-based or visual detection systems.

Sublime rule (View on GitHub)

 1name: "Body: CSS Hidden text via table-column"
 2description: "Detects inbound messages containing elements styled with 'display: table-column' combined with a height or width of zero, effectively hiding the element from visual rendering. The rule flags cases where the hidden element contains more than 100 non-whitespace characters of inner text, a technique commonly used to conceal content from human recipients while still embedding it in the DOM to evade text-based or visual detection systems."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(html.xpath(body.html, '//*[contains(@style,"table-column")]').nodes,
 8          regex.icontains(.raw, 'display\s*:\s*table-column')
 9          and (
10            regex.icontains(.raw, '[;"\s]height\s*:\s*0')
11            or regex.icontains(.raw, '[;"\s]width\s*:\s*0')
12          )
13          and regex.icount(.inner_text, '\S') > 100
14  )  
15attack_types:
16  - "Credential Phishing"
17  - "Spam"
18tactics_and_techniques:
19  - "Evasion"
20detection_methods:
21  - "HTML analysis"
22  - "Content analysis"
23id: "a2b8ef87-89d9-5ebb-9be4-9d4db8571e57"
to-top