Body: Yellow highlighted text markers

calendar Jul 28, 2026  ·
Share on: linkedin copy

Detects messages containing multiple HTML span elements with yellow background highlighting (rgb(255, 241, 0)) and data-markjs attributes, potentially indicating evasion techniques through visual markup manipulation.

Sublime rule (View on GitHub)

 1name: "Body: Yellow highlighted text markers"
 2description: "Detects messages containing multiple HTML span elements with yellow background highlighting (rgb(255, 241, 0)) and data-markjs attributes, potentially indicating evasion techniques through visual markup manipulation."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and regex.icount(body.html.raw, 'data-markjs="true"') >= 2
 8  and strings.icontains(body.html.raw, 'background-color: rgb(255, 241, 0)')  
 9attack_types:
10  - "Credential Phishing"
11  - "BEC/Fraud"
12tactics_and_techniques:
13  - "Evasion"
14detection_methods:
15  - "HTML analysis"
16  - "Content analysis"
17id: "869dd39d-02a5-59f2-8fa9-3922a8fd5467"
to-top