Detection rules › Sublime MQL
Attachment: HTML file with reference to recipient and suspicious patterns
Attached HTML file (or HTML file within an attached email) contains references to the recipients email address, indicative of credential phishing, and suspicious Javascript patterns.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | HTML smuggling, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.content_type == "text/html"
or (.content_type == "message/rfc822" or .file_extension in ('eml'))
or .file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_type == "html"
)
and any(file.explode(.),
.flavors.mime in~ ("text/html", "text/plain")
and any(recipients.to,
any(..scan.strings.strings,
strings.icontains(., ..email.email)
)
and (
.email.domain.valid
or strings.icontains(.display_name, "undisclosed")
)
)
)
and any(file.explode(.),
(
any(.flavors.yara, . == "javascript_file")
// common indicator of HTML smuggling
and length(filter(.scan.javascript.identifiers,
strings.ilike(., "_0x*")
)
) > 50
)
or (
// javascript that doesn't get pulled out properly
.flavors.mime == "text/plain"
and strings.ilike(.file_name, "script*")
// common indicator of HTML smuggling
and length(filter(.scan.strings.strings,
regex.imatch(., ".*_0x.*")
)
) > 50
)
)
)
Detection logic
Scope: inbound message.
Attached HTML file (or HTML file within an attached email) contains references to the recipients email address, indicative of credential phishing, and suspicious Javascript patterns.
- inbound message
any of
attachmentswhere all hold:any of:
- .content_type is 'text/html'
any of:
- .content_type is 'message/rfc822'
- .file_extension in ('eml')
- .file_extension in ('html', 'htm', 'shtml', 'dhtml')
- .file_type is 'html'
any of
file.explode(.)where all hold:- .flavors.mime in ('text/html', 'text/plain')
any of
recipients.towhere all hold:any of
.scan.strings.stringswhere:- strings.icontains(.)
any of:
- .email.domain.valid
- .display_name contains 'undisclosed'
any of
file.explode(.)where any holds:all of:
any of
.flavors.yarawhere:- . is 'javascript_file'
- length(filter(.scan.javascript.identifiers, strings.ilike(., '_0x*'))) > 50
all of:
- .flavors.mime is 'text/plain'
- .file_name matches 'script*'
- length(filter(.scan.strings.strings, regex.imatch(., '.*_0x.*'))) > 50
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, recipients.to, recipients.to[].display_name, recipients.to[].email.domain.valid, recipients.to[].email.email, type.inbound. Sensors: file.explode, regex.imatch, strings.icontains, strings.ilike.
Indicators matched (16)
| Field | Match | Value |
|---|---|---|
attachments[].content_type | equals | text/html |
attachments[].content_type | equals | message/rfc822 |
attachments[].file_extension | member | eml |
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_type | equals | html |
file.explode(attachments[])[].flavors.mime | member | text/html |
file.explode(attachments[])[].flavors.mime | member | text/plain |
strings.icontains | substring | undisclosed |
file.explode(attachments[])[].flavors.yara[] | equals | javascript_file |
4 more
strings.ilike | substring | _0x* |
file.explode(attachments[])[].flavors.mime | equals | text/plain |
strings.ilike | substring | script* |
regex.imatch | regex | .*_0x.* |