Service abuse: AWS S3 image map

calendar Nov 10, 2026  ·
Share on: linkedin copy

Detects inbound emails containing an HTML image map where the image source and clickable area links are both hosted on Amazon S3 (amazonaws.com). This technique abuses a trusted cloud storage service to host deceptive content and disguise malicious links behind an interactive image, helping evade traditional link-based detection.

Sublime rule (View on GitHub)

 1name: "Service abuse: AWS S3 image map"
 2description: "Detects inbound emails containing an HTML image map where the image source and clickable area links are both hosted on Amazon S3 (amazonaws.com). This technique abuses a trusted cloud storage service to host deceptive content and disguise malicious links behind an interactive image, helping evade traditional link-based detection."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(html.xpath(body.html, '//img[@usemap]/@src').nodes,
 8          strings.parse_url(.raw).domain.root_domain == "amazonaws.com"
 9  )
10  and any(html.xpath(body.html, '//area/@href').nodes,
11          strings.parse_url(.raw).domain.root_domain == "amazonaws.com"
12  )  
13attack_types:
14  - "Credential Phishing"
15  - "Spam"
16tactics_and_techniques:
17  - "Image as content"
18  - "Free file host"
19detection_methods:
20  - "HTML analysis"
21  - "URL analysis"
22id: "5cbaa876-7424-5602-ad27-49e1065601c1"
to-top