Attachment: HTML smuggling with setTimeout

calendar Jan 12, 2026  ยท
Share on: linkedin copy

Recursively scans files and archives to detect HTML smuggling techniques.

Sublime rule (View on GitHub)

 1name: "Attachment: HTML smuggling with setTimeout"
 2description: |
 3    Recursively scans files and archives to detect HTML smuggling techniques.
 4type: "rule"
 5severity: "high"
 6source: |
 7  type.inbound
 8  and any(attachments,
 9          .size <= 400
10          and (
11            .file_extension in~ ("html", "htm", "shtml", "dhtml")
12            or .file_extension in~ $file_extensions_common_archives
13            or .file_type == "html"
14          )
15          and any(file.explode(.),
16                  "setTimeout" in .scan.javascript.identifiers
17                  and any(.scan.strings.strings,
18                          strings.ilike(., "*location.href*")
19                  )
20          )
21  )  
22attack_types:
23  - "Credential Phishing"
24  - "Malware/Ransomware"
25tactics_and_techniques:
26  - "Evasion"
27  - "HTML smuggling"
28  - "Scripting"
29detection_methods:
30  - "Archive analysis"
31  - "Content analysis"
32  - "File analysis"
33  - "HTML analysis"
34  - "Javascript analysis"
35id: "4e0b2c32-d176-5351-9b74-1636179a8cda"
to-top