Attachment: Any HTML file (unsolicited)

 1name: "Attachment: Any HTML file (unsolicited)"
 2description: |
 3  Potential HTML smuggling attacks in unsolicited messages.
 4  Use if passing HTML files is not normal behavior in your environment.
 5  This rule may be expanded to inspect HTML attachments for suspicious code.  
 6references:
 7  - "https://ired.team/offensive-security/defense-evasion/file-smuggling-with-html-and-javascript"
 8  - "https://sandbox.sublimesecurity.com?id=106315e9-166a-4e0f-946e-88ff6fd5f9fd"
 9type: "rule"
10severity: "low"
11source: |
12  type.inbound
13  and any(attachments,
14          .file_extension in~ ('htm', 'html') or .file_type == "html"
15  )
16  and (
17    not profile.by_sender().solicited
18    or profile.by_sender().any_messages_malicious_or_spam
19  )
20  and not profile.by_sender().any_messages_benign
21  
22  // negate highly trusted sender domains unless they fail DMARC authentication or DMARC is missing
23  and not (
24    sender.email.domain.root_domain in $high_trust_sender_root_domains
25    and coalesce(headers.auth_summary.dmarc.pass, false)
26  )  
27tags:
28  - "Attack surface reduction"
29tactics_and_techniques:
30  - "HTML smuggling"
31detection_methods:
32  - "File analysis"
33  - "HTML analysis"
34  - "Sender analysis"
35id: "ef36763f-917d-5338-b1ac-84047334dce8"