Attachment: HTML smuggling with concatenation obfuscation

calendar Jan 12, 2026  ยท
Share on: linkedin copy

Recursively scans files and archives to detect HTML smuggling techniques.

Sublime rule (View on GitHub)

 1name: "Attachment: HTML smuggling with concatenation obfuscation"
 2description: |
 3    Recursively scans files and archives to detect HTML smuggling techniques.
 4references:
 5type: "rule"
 6severity: "high"
 7authors:
 8  - twitter: "vector_sec"
 9source: |
10  type.inbound
11  and any(attachments,
12          (
13            .file_extension in~ ("html", "htm", "shtml", "dhtml")
14            or .file_extension in~ $file_extensions_common_archives
15            or .file_type == "html"
16          )
17          and any(file.explode(.),
18                  any(.scan.strings.strings,
19                      strings.ilike(.,
20                                    "*CJzYyIuY29uY2F0KCJyaXB0Iik*",
21                                    '*"sc".concat("ript")*'
22                      )
23                  )
24          )
25  )  
26attack_types:
27  - "Credential Phishing"
28  - "Malware/Ransomware"
29tactics_and_techniques:
30  - "Evasion"
31  - "HTML smuggling"
32  - "Scripting"
33detection_methods:
34  - "Archive analysis"
35  - "Content analysis"
36  - "File analysis"
37  - "HTML analysis"
38id: "108ab346-bc11-5f96-916c-678891332ae8"
to-top