Attachment: HTML file with reference to recipient and suspicious patterns

 1name: "Attachment: HTML file with reference to recipient and suspicious patterns"
 2description: |
 3    Attached HTML file (or HTML file within an attached email) contains references to the recipients email address, indicative of credential phishing, and suspicious Javascript patterns.
 4type: "rule"
 5severity: "high"
 6source: |
 7  type.inbound
 8  and any(attachments,
 9          (
10            .content_type == "text/html"
11            or .content_type == "message/rfc822"
12            or .file_extension in~ ("html", "htm", "shtml", "dhtml")
13            or .file_type == "html"
14          )
15          and any(file.explode(.),
16                  .flavors.mime in~ ("text/html", "text/plain")
17                  and any(recipients.to,
18                          any(..scan.strings.strings,
19                              strings.icontains(., ..email.email)
20                          )
21                          and (.email.domain.valid or strings.icontains(.display_name, "undisclosed"))
22                  )
23          )
24          and any(file.explode(.),
25                  (
26                    any(.flavors.yara, . == "javascript_file")
27                    // common indicator of HTML smuggling
28                    and length(filter(.scan.javascript.identifiers, strings.ilike(., "_0x*"))) > 50
29                  )
30                  or (
31                    // javascript that doesn't get pulled out properly
32                    .flavors.mime == "text/plain"
33                    and strings.ilike(.file_name, "script*")
34                    // common indicator of HTML smuggling
35                    and length(filter(.scan.strings.strings, regex.imatch(., ".*_0x.*"))) > 50
36                  )
37          )
38  )  
39attack_types:
40  - "Credential Phishing"
41tactics_and_techniques:
42  - "HTML smuggling"
43  - "Scripting"
44detection_methods:
45  - "Content analysis"
46  - "File analysis"
47  - "HTML analysis"
48  - "Javascript analysis"
49  - "YARA"
50id: "5333493d-48a8-532d-a621-d278a59bbf9b"