HTML: Bidirectional (BIDI) HTML override with right to left obfuscation

 1name: "HTML: Bidirectional (BIDI) HTML override with right to left obfuscation"
 2description: "Body HTML contains multiple instances of right-to-left (RTL) text direction override markup, which can be used to visually manipulate text display and potentially bypass common strings checks."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // You should only observe RTL injection when RTL languages are present.
 8  and (
 9    regex.icount(body.html.raw, 'unicode-bidi\s*:\s*bidi-override[^>]*rtl') + regex.icount(body.html.raw,
10                                                                                           '<bdo dir="rtl">'
11    )
12  // Count allows for scalability for FP's.
13  ) >= 3
14  // exclude legitimate CSS star-rating widgets
15  and not regex.icontains(body.html.raw, '\.rating[^}]*:hover')  
16
17attack_types:
18  - "BEC/Fraud"
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Evasion"
22  - "Social engineering"
23  - "Scripting"
24detection_methods:
25  - "Content analysis"
26  - "HTML analysis"
27id: "f93940d2-0713-5a4c-8864-3d3441b5fd5a"