Attachment: HTML smuggling with embedded base64-encoded executable

calendar Mar 25, 2024  ยท
Share on: linkedin copy

HTML attachmemt contains a base-64 encoded executable.

Sublime rule (View on GitHub)

 1name: "Attachment: HTML smuggling with embedded base64-encoded executable"
 2description: |
 3    HTML attachmemt contains a base-64 encoded executable.
 4references:
 5  - "https://delivr.to/payloads?id=739e977c-8e8f-4ba8-940a-c53ba77cecca"
 6  - "https://www.microsoft.com/en-us/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium"
 7  - "https://sandbox.sublimesecurity.com?id=28fe5e67-2dec-4072-a263-24ee53cc54c3"
 8type: "rule"
 9severity: "high"
10source: |
11  type.inbound
12  and any(attachments,
13          (
14            .file_extension in~ ("html", "htm", "shtml", "dhtml")
15            or .file_extension in~ $file_extensions_common_archives
16            or .file_type == "html"
17          )
18          and any(file.explode(.),
19                  (
20                    .file_extension in~ ("html", "htm", "shtml", "dhtml")
21                    or .flavors.mime == "text/plain"
22                  )
23                  and any(.flavors.yara, . == 'base64_pe')
24          )
25  )  
26attack_types:
27  - "Malware/Ransomware"
28tactics_and_techniques:
29  - "Evasion"
30  - "HTML smuggling"
31detection_methods:
32  - "Archive analysis"
33  - "File analysis"
34  - "HTML analysis"
35  - "YARA"
36id: "b00c4527-957c-53ba-9eee-c5ef555b24e3"
to-top