Email Body Contains Escape-Character-Isolated Instruction Block (Prompt Injection Staging)
This rule identifies suspicious email messages that contain isolated blocks of text preceded by at least two whitespace characters (including newlines, carriage returns, or tabs). This pattern is often used by threat actors to obfuscate content, attempt to bypass email gateway filters, or hide malicious strings from security scanners by breaking up content flow.
Cortex XDR
