Detection rules › Sublime MQL
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts
Detects messages with HTML attachments containing multiple 'const' declarations while excluding legitimate Gmail messages. This is evidence of potential code injection or obfuscation techniques.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware, Credential Phishing |
| Tactics and techniques | HTML smuggling, Scripting, Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_type == "html"
)
and strings.count(file.parse_html(.).raw, 'const') >= 7
and not regex.contains(file.parse_html(.).raw,
"<!-- saved from url=.{0,7}https://mail.google.com/mail/u/0/#inbox/"
)
and length(file.parse_html(.).raw) < 50000
// long timeouts
and regex.icontains(file.parse_html(.).raw,
'setTimeout\(\s*(?:function\s*)?\(.*?\)\s*(?:=>\s*)?\{[\s\S]*?\},\s*\d+\);',
// const delay = new Promise((resolve) => setTimeout(resolve, 100));
'setTimeout\(\s*\w+\,\s*\d{3,}\)+;'
)
)
// negate highly trusted sender domains unless they fail DMARC authentication or DMARC is missing
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects messages with HTML attachments containing multiple 'const' declarations while excluding legitimate Gmail messages. This is evidence of potential code injection or obfuscation techniques.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('html', 'htm', 'shtml', 'dhtml')
- .file_type is 'html'
- strings.count(file.parse_html(.).raw, 'const') ≥ 7
not:
- file.parse_html(.).raw matches '<!-- saved from url=.{0,7}https://mail.google.com/mail/u/0/#inbox/'
- length(file.parse_html(.).raw) < 50000
file.parse_html(.).raw matches any of 2 patterns
setTimeout\(\s*(?:function\s*)?\(.*?\)\s*(?:=>\s*)?\{[\s\S]*?\},\s*\d+\);setTimeout\(\s*\w+\,\s*\d{3,}\)+;
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: attachments[].file_extension, attachments[].file_type, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.parse_html, regex.contains, regex.icontains, strings.count. Reference lists: $high_trust_sender_root_domains.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_type | equals | html |
regex.contains | regex | <!-- saved from url=.{0,7}https://mail.google.com/mail/u/0/#inbox/ |
regex.icontains | regex | setTimeout\(\s*(?:function\s*)?\(.*?\)\s*(?:=>\s*)?\{[\s\S]*?\},\s*\d+\); |
regex.icontains | regex | setTimeout\(\s*\w+\,\s*\d{3,}\)+; |