Attachment: HTML smuggling with decimal encoding

 1name: "Attachment: HTML smuggling with decimal encoding"
 2description: |
 3    Potential HTML smuggling attack based on large blocks of decimal encoding. Attackers often use decimal encoding as an obfuscation technique to bypass traditional email security measures. 
 4type: "rule"
 5severity: "high"
 6source: |
 7  type.inbound
 8  and any(attachments,
 9          (
10            .file_extension in~ ("html", "htm", "shtml", "dhtml", "xhtml")
11            or (
12              .file_extension is null
13              and .file_type == "unknown"
14              and .content_type == "application/octet-stream"
15            )
16            or .file_extension in~ $file_extensions_common_archives
17            or .file_type == "html"
18            or .content_type == "text/html"
19          )
20          and any(file.explode(.),
21                  // suspicious identifiers
22                  any(.scan.strings.strings,
23                      regex.contains(., '(\d{2,3},){60,}')
24                  )
25          )
26  )
27  // negate highly trusted sender domains unless they fail DMARC authentication
28  and (
29    (
30      sender.email.domain.root_domain in $high_trust_sender_root_domains
31      and not headers.auth_summary.dmarc.pass
32    )
33    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
34  )
35  
36  and (
37    not profile.by_sender().solicited
38    or (
39      profile.by_sender().any_messages_malicious_or_spam
40      and not profile.by_sender().any_false_positives
41    )
42  )
43  and not profile.by_sender().any_false_positives  
44attack_types:
45  - "Credential Phishing"
46  - "Malware/Ransomware"
47tactics_and_techniques:
48  - "Evasion"
49  - "HTML smuggling"
50  - "Scripting"
51detection_methods:
52  - "Archive analysis"
53  - "Content analysis"
54  - "File analysis"
55  - "HTML analysis"
56id: "f99213c4-7031-50b1-ae81-b45f790d3fa4"