Detection rules › Sublime MQL
Attachment: HTML smuggling with excessive string concatenation and suspicious patterns
Attached HTML file contains excessive string concatenation, a recipient's email address, and an indicator of HTML smuggling. This pattern has been seen in the wild in an attempt to obfuscate the file's contents.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, HTML smuggling, Scripting, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
// HTML file, or something like it
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
and .size < 100000000
)
or .file_type == "html"
)
// small HTML file
and .size < 5000
// lots of concatenation (obfuscation technique)
and strings.count(file.parse_html(.).raw, "+") > 20
// contains a recipient's email address
and any(recipients.to,
strings.icontains(file.parse_html(..).raw, .email.email)
and .email.domain.valid
)
// HTML smuggling
and 1 of (
strings.ilike(file.parse_html(.).raw, "*window.location.href*"),
strings.ilike(file.parse_html(.).raw, "*createObjectURL*")
)
)
Detection logic
Scope: inbound message.
Attached HTML file contains excessive string concatenation, a recipient's email address, and an indicator of HTML smuggling. This pattern has been seen in the wild in an attempt to obfuscate the file's contents.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('html', 'htm', 'shtml', 'dhtml')
all of:
- .file_extension is missing
- .file_type is 'unknown'
- .content_type is 'application/octet-stream'
- .size < 100000000
- .file_type is 'html'
- .size < 5000
- strings.count(file.parse_html(.).raw, '+') > 20
any of
recipients.towhere all hold:- strings.icontains(file.parse_html(.).raw)
- .email.domain.valid
at least 1 of:
- file.parse_html(.).raw matches '*window.location.href*'
- file.parse_html(.).raw matches '*createObjectURL*'
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, attachments[].size, recipients.to, recipients.to[].email.domain.valid, recipients.to[].email.email, type.inbound. Sensors: file.parse_html, strings.count, strings.icontains, strings.ilike.
Indicators matched (9)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_type | equals | unknown |
attachments[].content_type | equals | application/octet-stream |
attachments[].file_type | equals | html |
strings.ilike | substring | *window.location.href* |
strings.ilike | substring | *createObjectURL* |