Attachment: Embedded VBScript in MHT file (unsolicited)
MHT files can be used to run VBScript, which can run malicious code.
Sublime rule (View on GitHub)
1name: "Attachment: Embedded VBScript in MHT file (unsolicited)"
2description: |
3 MHT files can be used to run VBScript, which can run malicious code.
4references:
5 - "https://delivr.to/payloads?id=edc7744f-78bc-4c18-9554-58c35ba9aca5"
6type: "rule"
7severity: "medium"
8source: |
9 type.inbound
10 and any(attachments,
11 (.file_extension =~ "mht" or .file_extension in~ $file_extensions_common_archives)
12
13 // ensure there's an mht file (if it's in an archive)
14 and any(file.explode(.), .file_extension =~ "mht")
15 and any(file.explode(.), any(.scan.html.scripts, .language == "VBScript"))
16 )
17 and (
18 not profile.by_sender().solicited
19 or (
20 profile.by_sender().any_messages_malicious_or_spam
21 and not profile.by_sender().any_messages_benign
22 )
23 )
24attack_types:
25 - "Malware/Ransomware"
26tactics_and_techniques:
27 - "Evasion"
28 - "Scripting"
29detection_methods:
30 - "Archive analysis"
31 - "File analysis"
32 - "HTML analysis"
33 - "Sender analysis"
34id: "b30353a6-773e-5b6d-9252-751b5bc95799"