Detection rules › Sublime MQL
Attachment: HTML with JavaScript functions for HTTP requests
This rule identifies HTML attachments which contain multiple references to JavaScript functions that support making HTTP requests. This has been observed in phishing campaigns to load remote payloads into otherwise benign HTML attachments.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and not profile.by_sender().solicited
// not high trust sender domains
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and any(attachments,
.file_extension in~ ("html", "htm", "shtml", "dhtml")
and 3 of (
strings.icontains(file.parse_html(.).raw, '.replace'),
strings.icontains(file.parse_html(.).raw, 'XMLHttpRequest'),
strings.icontains(file.parse_html(.).raw, 'onreadystate'),
strings.icontains(file.parse_html(.).raw, 'GET'),
strings.icontains(file.parse_html(.).raw, 'send()'),
strings.icontains(file.parse_html(.).raw, 'responseText'),
)
)
Detection logic
Scope: inbound message.
This rule identifies HTML attachments which contain multiple references to JavaScript functions that support making HTTP requests. This has been observed in phishing campaigns to load remote payloads into otherwise benign HTML attachments.
- inbound message
not:
- profile.by_sender().solicited
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
any of
attachmentswhere all hold:- .file_extension in ('html', 'htm', 'shtml', 'dhtml')
at least 3 of 6: file.parse_html(.).raw contains any of 6 patterns
.replaceXMLHttpRequestonreadystateGETsend()responseText
Inspects: attachments[].file_extension, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.parse_html, profile.by_sender, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
strings.icontains | substring | .replace |
strings.icontains | substring | XMLHttpRequest |
strings.icontains | substring | onreadystate |
strings.icontains | substring | GET |
strings.icontains | substring | send() |
strings.icontains | substring | responseText |