Attachment: Any HTML file (untrusted sender)

 1name: "Attachment: Any HTML file (untrusted sender)"
 2description: |
 3  Potential HTML smuggling attacks from new senders.
 4  Use if passing HTML files is not normal behavior in your environment.
 5  This rule may be expanded to inspect HTML attachments for suspicious code.  
 6references:
 7  - "https://ired.team/offensive-security/defense-evasion/file-smuggling-with-html-and-javascript"
 8  - "https://sandbox.sublimesecurity.com?id=106315e9-166a-4e0f-946e-88ff6fd5f9fd"
 9type: "rule"
10severity: "medium"
11source: |
12  type.inbound
13  and any(attachments,
14          .file_extension in~ ('htm', 'html') or .file_type == "html"
15  )
16  and (
17    (
18      profile.by_sender().prevalence in ("new", "outlier")
19      and not profile.by_sender().solicited
20    )
21    or profile.by_sender().any_messages_malicious_or_spam
22  )
23  and not profile.by_sender().any_messages_benign
24  
25  // negate highly trusted sender domains unless they fail DMARC authentication or DMARC is missing
26  and not (
27    sender.email.domain.root_domain in $high_trust_sender_root_domains
28    and coalesce(headers.auth_summary.dmarc.pass, false)
29  )  
30tags:
31  - "Attack surface reduction"
32tactics_and_techniques:
33  - "HTML smuggling"
34detection_methods:
35  - "HTML analysis"
36  - "Sender analysis"
37id: "57a8f5c5-c4c4-5268-b452-e381dc64ea42"