Link: Credential harvesting with excess padding evasion

 1name: "Link: Credential harvesting with excess padding evasion"
 2description: "Detects inbound messages containing credential-related action links with tall screenshot images and HTML padding techniques used to evade detection. The rule identifies messages with excessive empty div tags, non-breaking spaces, or large margin-top values that artificially increase content height while hiding malicious intent."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // CTA link with action-oriented display text pointing to a different domain than the sender
 8  and any(body.current_thread.links,
 9          regex.icontains(.display_text,
10                          '(?:open|sign.?in|log.?in|retain|credential|secure|confirm|accept|release|review|document)'
11          )
12          and .href_url.domain.root_domain != sender.email.domain.root_domain
13          and not regex.icontains(.display_text, 'open source')
14  )
15  // tall rendered email with low word density
16  and beta.parse_exif(file.message_screenshot()).image_height > 1500
17  and beta.parse_exif(file.message_screenshot()).image_height * 100 / regex.count(body.html.display_text,
18                                                                                  '\S+'
19  ) > 500
20  // html whitespace stuffing patterns
21  and (
22    // bare div-br blocks repeated 30+ times
23    regex.icontains(body.html.raw, '(?:<div>\s*<br\s*/?\s*>\s*</div>\s*){30,}')
24    // style div-br blocks repeated 20+ times
25    or regex.icontains(body.html.raw,
26                       '(?:<div\s+style="[^"]+"\s*[^>]*>\s*<br\s*/?\s*>\s*</div>\s*){20,}'
27    )
28    // attributed empty div-nbsp blocks repeated 20+ times (styled/classed empty divs, e.g. Outlook Aptos)
29    // requires an attribute to avoid bare <div>&nbsp;</div> newsletter spacers
30    or (
31      regex.icontains(body.html.raw,
32                      '(?:<div\s+[^>]+>\s*(?:&nbsp;|&#160;)\s*</div>\s*){20,}'
33      )
34      // exclude collapsed/hidden empty divs (display:none, font-size:0, line-height:0)
35      // these render to zero height and are ESP preheader artifacts, not visible stuffing
36      and not regex.icontains(body.html.raw,
37                              '(?:<div\s+[^>]*(?:display\s*:\s*none|font-size\s*:\s*0|line-height\s*:\s*0)[^>]*>\s*(?:&nbsp;|&#160;)\s*</div>\s*){20,}'
38      )
39    )
40    // p-nbsp blocks repeated 25+ times
41    or regex.icontains(body.html.raw,
42                       '(?:<p>\s*(?:&nbsp;|&#160;)\s*</p>\s*){25,}'
43    )
44    // css margin-top pushdown >= 1500px
45    or (
46      regex.icontains(body.html.raw,
47                      'margin-top\s*:\s*(?:1[5-9]\d{2}|[2-9]\d{3}|\d{5,})px'
48      )
49      and not regex.icontains(body.html.raw,
50                              'position\s*:\s*absolute[^"]*margin-top\s*:\s*(?:1[5-9]\d{2}|[2-9]\d{3}|\d{5,})px'
51      )
52      and not regex.icontains(body.html.raw,
53                              'margin-left\s*:\s*\d{3,}px[^"]*margin-top\s*:\s*(?:1[5-9]\d{2}|[2-9]\d{3}|\d{5,})px'
54      )
55    )
56  )  
57
58attack_types:
59  - "Credential Phishing"
60tactics_and_techniques:
61  - "Evasion"
62  - "Social engineering"
63detection_methods:
64  - "Content analysis"
65  - "HTML analysis"
66  - "Exif analysis"
67  - "URL screenshot"
68id: "5591f618-aed0-579d-9875-cdebdd72c6d2"