Attachment: HTML smuggling with decimal encoding

 1name: "Attachment: HTML smuggling with decimal encoding"
 2description: |
 3    Potential HTML smuggling attack based on large blocks of decimal encoding. Attackers often use decimal encoding as an obfuscation technique to bypass traditional email security measures. 
 4type: "rule"
 5severity: "high"
 6source: |
 7  type.inbound
 8  and any(attachments,
 9          (
10            .file_extension in~ ("html", "htm", "shtml", "dhtml", "xhtml")
11            or (
12              .file_extension is null
13              and .file_type == "unknown"
14              and .content_type == "application/octet-stream"
15            )
16            or .file_extension in~ $file_extensions_common_archives
17            or .file_type == "html"
18            or .content_type == "text/html"
19          )
20          and any(file.explode(.),
21                  // suspicious identifiers
22                  any(.scan.strings.strings, regex.contains(., '(\d{2,3},){60,}'))
23          )
24  )
25  // negate highly trusted sender domains unless they fail DMARC authentication
26  and (
27    (
28      sender.email.domain.root_domain in $high_trust_sender_root_domains
29      and not headers.auth_summary.dmarc.pass
30    )
31    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
32  )
33  and (
34    not profile.by_sender().solicited
35    or (
36      profile.by_sender().any_messages_malicious_or_spam
37      and not profile.by_sender().any_messages_benign
38    )
39  )
40  and not profile.by_sender().any_messages_benign  
41attack_types:
42  - "Credential Phishing"
43  - "Malware/Ransomware"
44tactics_and_techniques:
45  - "Evasion"
46  - "HTML smuggling"
47  - "Scripting"
48detection_methods:
49  - "Archive analysis"
50  - "Content analysis"
51  - "File analysis"
52  - "HTML analysis"
53id: "f99213c4-7031-50b1-ae81-b45f790d3fa4"