Attachment: Embedded VBScript in MHT file

calendar May 14, 2026  ยท
Share on: linkedin copy

MHT files can be used to run VBScript, which can run malicious code.

Sublime rule (View on GitHub)

 1name: "Attachment: Embedded VBScript in MHT file"
 2description: |
 3    MHT files can be used to run VBScript, which can run malicious code.
 4references:
 5  - "https://delivr.to/payloads?id=edc7744f-78bc-4c18-9554-58c35ba9aca5"
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and any(attachments,
11          (
12            .file_extension =~ "mht"
13            or .file_extension in~ $file_extensions_common_archives
14          )
15  
16          // ensure there's an mht file (if it's in an archive)
17          and any(file.explode(.), .file_extension =~ "mht")
18          and any(file.explode(.),
19                  any(.scan.html.scripts, .language == "VBScript")
20          )
21  )  
22attack_types:
23  - "Malware/Ransomware"
24tactics_and_techniques:
25  - "Evasion"
26  - "Scripting"
27detection_methods:
28  - "Archive analysis"
29  - "File analysis"
30  - "HTML analysis"
31id: "b30353a6-773e-5b6d-9252-751b5bc95799"
to-top