Evasion: Fragmented image body via shared CID hash

calendar Nov 5, 2026  ·
Share on: linkedin copy

Detects inbound messages whose visible body is nearly empty while the HTML references four or more embedded images that share the same content-ID base hash, differing only by index. This is the fingerprint of a single image sliced into multiple tiles and reassembled via an HTML table layout, an evasion technique that hides the message content from text and URL based scanning while rendering as one coherent image to the recipient.

Sublime rule (View on GitHub)

 1name: "Evasion: Fragmented image body via shared CID hash"
 2description: "Detects inbound messages whose visible body is nearly empty while the HTML references four or more embedded images that share the same content-ID base hash, differing only by index. This is the fingerprint of a single image sliced into multiple tiles and reassembled via an HTML table layout, an evasion technique that hides the message content from text and URL based scanning while rendering as one coherent image to the recipient."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(regex.iextract(body.html.raw, 'cid:([a-f0-9]{16,})\.\d{1,3}@'),
 8          length(filter(html.xpath(body.html, '//img/@src').nodes,
 9                        strings.icontains(.raw, ..groups[0])
10                 )
11          ) >= 4
12  )  
13attack_types:
14  - "Credential Phishing"
15  - "Callback Phishing"
16tactics_and_techniques:
17  - "Image as content"
18  - "Social engineering"
19detection_methods:
20  - "HTML analysis"
21  - "Content analysis"
22id: "80ce2ce8-29f2-5d64-b5b8-6d9e782c8a09"
to-top