Attachment: Embedded VBScript in MHT file (unsolicited)

calendar Jul 16, 2025  ยท
Share on: linkedin copy

MHT files can be used to run VBScript, which can run malicious code.

Sublime rule (View on GitHub)

 1name: "Attachment: Embedded VBScript in MHT file (unsolicited)"
 2description: |
 3    MHT files can be used to run VBScript, which can run malicious code.
 4references:
 5  - "https://delivr.to/payloads?id=edc7744f-78bc-4c18-9554-58c35ba9aca5"
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and any(attachments,
11          (.file_extension =~ "mht" or .file_extension in~ $file_extensions_common_archives)
12
13          // ensure there's an mht file (if it's in an archive)
14          and any(file.explode(.), .file_extension =~ "mht")
15          and any(file.explode(.), any(.scan.html.scripts, .language == "VBScript"))
16  )
17  and (
18    not profile.by_sender().solicited
19    or (
20      profile.by_sender().any_messages_malicious_or_spam
21      and not profile.by_sender().any_messages_benign
22    )
23  )  
24attack_types:
25  - "Malware/Ransomware"
26tactics_and_techniques:
27  - "Evasion"
28  - "Scripting"
29detection_methods:
30  - "Archive analysis"
31  - "File analysis"
32  - "HTML analysis"
33  - "Sender analysis"
34id: "b30353a6-773e-5b6d-9252-751b5bc95799"
to-top