Link: Suspicious HTML structure with subject mirrored in body and single link

calendar Jul 27, 2026  ·
Share on: linkedin copy

Detects messages where the subject is mirrored in a styled HTML table element, while containing exactly one link. This structural pattern is indicative of templated lures designed to appear legitimate.

Sublime rule (View on GitHub)

 1name: "Link: Suspicious HTML structure with subject mirrored in body and single link"
 2description: "Detects messages where the subject is mirrored in a styled HTML table element, while containing exactly one link. This structural pattern is indicative of templated lures designed to appear legitimate."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(html.xpath(body.html,
 8                     '//body/div//table/tbody/tr//table/tbody/tr/td[contains(@style, "rgb(41, 88, 140)")]/div/b'
 9          ).nodes,
10          subject.base == .display_text
11  )
12  and any(html.xpath(body.html,
13                     '//body/div//table/tbody/tr//table/tbody/tr/td/div[contains(@style, "margin-top: 12pt")]/div'
14          ).nodes,
15          strings.icontains(subject.base, .inner_text)
16  )
17  and length(html.xpath(body.html,
18                        '//body/div//table/tbody/tr//table/tbody/tr/td/div[contains(@style, "margin-top: 12pt")]/div//a'
19             ).nodes
20  ) == 1  
21attack_types:
22  - "Credential Phishing"
23tactics_and_techniques:
24  - "Social engineering"
25  - "Impersonation: Brand"
26detection_methods:
27  - "Content analysis"
28  - "HTML analysis"
29id: "bb5986b8-3bd2-52b5-813f-3e7f2fec6f29"
to-top