Attachment: HTML smuggling with decimal encoding

 1name: "Attachment: HTML smuggling with decimal encoding"
 2description: |
 3    Potential HTML smuggling attack based on large blocks of decimal encoding. Attackers often use decimal encoding as an obfuscation technique to bypass traditional email security measures. 
 4type: "rule"
 5severity: "high"
 6source: |
 7  type.inbound
 8  and any(attachments,
 9          (
10            .file_extension in~ ("html", "htm", "shtml", "dhtml", "xhtml")
11            or (
12              .file_extension is null
13              and .file_type == "unknown"
14              and .content_type == "application/octet-stream"
15            )
16            or .file_extension in~ $file_extensions_common_archives
17            or .file_type == "html"
18            or .content_type == "text/html"
19          )
20          and any(file.explode(.),
21                  // suspicious identifiers
22                  any(.scan.strings.strings, regex.contains(., '(\d{2,3},){60,}'))
23          )
24  )
25  // negate highly trusted sender domains unless they fail DMARC authentication
26  and not (
27    sender.email.domain.root_domain in $high_trust_sender_root_domains
28    and coalesce(headers.auth_summary.dmarc.pass, false)
29  )
30  and (
31    not profile.by_sender().solicited
32    or (
33      profile.by_sender().any_messages_malicious_or_spam
34      and not profile.by_sender().any_messages_benign
35    )
36  )
37  and not profile.by_sender().any_messages_benign  
38attack_types:
39  - "Credential Phishing"
40  - "Malware/Ransomware"
41tactics_and_techniques:
42  - "Evasion"
43  - "HTML smuggling"
44  - "Scripting"
45detection_methods:
46  - "Archive analysis"
47  - "Content analysis"
48  - "File analysis"
49  - "HTML analysis"
50id: "f99213c4-7031-50b1-ae81-b45f790d3fa4"