Attachment: HTML file with reference to recipient and suspicious patterns
Attached HTML file (or HTML file within an attached email) contains references to the recipients email address, indicative of credential phishing, and suspicious Javascript patterns.
Sublime rule (View on GitHub)
1name: "Attachment: HTML file with reference to recipient and suspicious patterns"
2description: |
3 Attached HTML file (or HTML file within an attached email) contains references to the recipients email address, indicative of credential phishing, and suspicious Javascript patterns.
4type: "rule"
5severity: "high"
6source: |
7 type.inbound
8 and any(attachments,
9 (
10 .content_type == "text/html"
11 or .content_type == "message/rfc822"
12 or .file_extension in~ ("html", "htm", "shtml", "dhtml")
13 or .file_type == "html"
14 )
15 and any(file.explode(.),
16 .flavors.mime in~ ("text/html", "text/plain")
17 and any(recipients.to,
18 any(..scan.strings.strings,
19 strings.icontains(., ..email.email)
20 )
21 and (.email.domain.valid or strings.icontains(.display_name, "undisclosed"))
22 )
23 )
24 and any(file.explode(.),
25 (
26 any(.flavors.yara, . == "javascript_file")
27 // common indicator of HTML smuggling
28 and length(filter(.scan.javascript.identifiers, strings.ilike(., "_0x*"))) > 50
29 )
30 or (
31 // javascript that doesn't get pulled out properly
32 .flavors.mime == "text/plain"
33 and strings.ilike(.file_name, "script*")
34 // common indicator of HTML smuggling
35 and length(filter(.scan.strings.strings, regex.imatch(., ".*_0x.*"))) > 50
36 )
37 )
38 )
39attack_types:
40 - "Credential Phishing"
41tactics_and_techniques:
42 - "HTML smuggling"
43 - "Scripting"
44detection_methods:
45 - "Content analysis"
46 - "File analysis"
47 - "HTML analysis"
48 - "Javascript analysis"
49 - "YARA"
50id: "5333493d-48a8-532d-a621-d278a59bbf9b"