Attachment: HTML smuggling with eval and atob

calendar Jan 12, 2026  ยท
Share on: linkedin copy

Recursively scans files and archives to detect HTML smuggling techniques.

Sublime rule (View on GitHub)

 1name: "Attachment: HTML smuggling with eval and atob"
 2description: |
 3    Recursively scans files and archives to detect HTML smuggling techniques.
 4type: "rule"
 5severity: "high"
 6source: |
 7  type.inbound
 8  and any(attachments,
 9          (
10            .file_extension in~ ("html", "htm", "shtml", "dhtml")
11            or .file_extension in~ $file_extensions_common_archives
12            or .file_type == "html"
13          )
14          and any(file.explode(.),
15                  // usage: onerror="eval(atob('
16                  any(.scan.strings.strings,
17                      regex.imatch(., ".*eval.{1,4}atob.*")
18                  )
19          )
20  )  
21attack_types:
22  - "Credential Phishing"
23  - "Malware/Ransomware"
24tactics_and_techniques:
25  - "Evasion"
26  - "HTML smuggling"
27  - "Scripting"
28detection_methods:
29  - "Archive analysis"
30  - "Content analysis"
31  - "File analysis"
32  - "HTML analysis"
33  - "Javascript analysis"
34id: "9f521ca2-2141-5373-86b1-e3cf8ed8d633"
to-top