Attachment: Embedded VBScript in MHT file (unsolicited)

calendar Jan 12, 2026  ยท
Share on: linkedin copy

MHT files can be used to run VBScript, which can run malicious code.

Sublime rule (View on GitHub)

 1name: "Attachment: Embedded VBScript in MHT file (unsolicited)"
 2description: |
 3    MHT files can be used to run VBScript, which can run malicious code.
 4references:
 5  - "https://delivr.to/payloads?id=edc7744f-78bc-4c18-9554-58c35ba9aca5"
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and any(attachments,
11          (
12            .file_extension =~ "mht"
13            or .file_extension in~ $file_extensions_common_archives
14          )
15  
16          // ensure there's an mht file (if it's in an archive)
17          and any(file.explode(.), .file_extension =~ "mht")
18          and any(file.explode(.),
19                  any(.scan.html.scripts, .language == "VBScript")
20          )
21  )
22  and (
23    not profile.by_sender().solicited
24    or (
25      profile.by_sender().any_messages_malicious_or_spam
26      and not profile.by_sender().any_messages_benign
27    )
28  )  
29attack_types:
30  - "Malware/Ransomware"
31tactics_and_techniques:
32  - "Evasion"
33  - "Scripting"
34detection_methods:
35  - "Archive analysis"
36  - "File analysis"
37  - "HTML analysis"
38  - "Sender analysis"
39id: "b30353a6-773e-5b6d-9252-751b5bc95799"
to-top