Body HTML: Comment with 24-character hex token

 1name: "Body HTML: Comment with 24-character hex token"
 2description: "Detects messages containing HTML comments with exactly 24 hexadecimal characters, which may indicate tracking tokens, session identifiers, or other suspicious embedded data used for evasion or tracking purposes."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and any(html.xpath(body.html, '//comment()').nodes,
 8          regex.imatch(.raw, '<!--\s*[a-f0-9]{24}\s*-->')
 9  )
10  and not (
11    sender.email.domain.root_domain in $high_trust_sender_root_domains
12    and coalesce(headers.auth_summary.dmarc.pass, false)
13  )
14  and any(ml.nlu_classifier(body.current_thread.text).intents,
15          .name in ("cred_theft", "bec") and .confidence != 'low'
16  )  
17tags:
18 - "Attack surface reduction"
19attack_types:
20  - "Spam"
21tactics_and_techniques:
22  - "Evasion"
23detection_methods:
24  - "Content analysis"
25  - "HTML analysis"
26id: "2a5da530-3c80-5b05-83cd-ae092ef68a0d"