detection.wiki

Detection rules › Sublime MQL

Attachment: HTML smuggling with atob and high entropy

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Recursively scans files and archives to detect HTML smuggling techniques using Javascript atob functions.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesHTML smuggling, Scripting

Event coverage

Message attribute
attachments (collection)
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and any(attachments,
        (
          .file_extension in~ ("html", "htm", "shtml", "dhtml", "eml")
          or .file_extension in~ $file_extensions_common_archives
          or .file_type == "html"
          or .content_type == "message/rfc822"
          or .file_extension in ('eml')
        )
        and any(file.explode(.),
                .scan.entropy.entropy >= 5
                and (
                  length(filter(.scan.javascript.identifiers,
                                strings.like(., "document", "write", "atob")
                         )
                  ) == 3
                  // usage: document['write'](atob)
                  or any(.scan.strings.strings,
                         regex.icontains(., "document.{0,10}write.{0,10}atob")
                  )
                  // usage: some_var = atob();
                  or any(.scan.strings.strings,
                         regex.icontains(., "=.?atob.*;")
                  )
                  // usage: atob(atob
                  or any(.scan.strings.strings, strings.ilike(., "*atob?atob*"))
                  // usage: {src: atob
                  or any(.scan.strings.strings,
                         strings.ilike(., "*{src: atob*")
                  )
                  // usage: eval(atob)
                  or any(.scan.strings.strings, strings.ilike(., "*eval?atob*"))
                  // usage: atob(_0x)
                  or any(.scan.strings.strings, strings.ilike(., "*atob(?0x*"))
                  // usage : 'at'+'ob'
                  or any(.scan.strings.strings, strings.ilike(., "*'at'+'ob'*"))
                  // usage: obfuscating "atob"
                  or any(.scan.javascript.identifiers,
                         strings.ilike(., '*ato\u0062*')
                  )
                  // usage: document.head.insertAdjacentHTML("beforeend", atob(...
                  or any(.scan.strings.strings,
                         strings.ilike(., "*document*insertAdjacentHTML*atob*")
                  )
                )
        )
)
// negate bouncebacks and undeliverables
and not any(attachments,
            .content_type in (
              "message/global-delivery-status",
              "message/delivery-status"
            )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Recursively scans files and archives to detect HTML smuggling techniques using Javascript atob functions.

  1. inbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension in ('html', 'htm', 'shtml', 'dhtml', 'eml')
      • .file_extension in $file_extensions_common_archives
      • .file_type is 'html'
      • .content_type is 'message/rfc822'
      • .file_extension in ('eml')
    • any of file.explode(.) where all hold:
      • .scan.entropy.entropy ≥ 5
      • any of:
        • length(filter(.scan.javascript.identifiers, strings.like(., 'document', 'write', 'atob'))) is 3
        • any of .scan.strings.strings where:
          • . matches 'document.{0,10}write.{0,10}atob'
        • any of .scan.strings.strings where:
          • . matches '=.?atob.*;'
        • any of .scan.strings.strings where:
          • . matches '*atob?atob*'
        • any of .scan.strings.strings where:
          • . matches '*{src: atob*'
        • any of .scan.strings.strings where:
          • . matches '*eval?atob*'
        • any of .scan.strings.strings where:
          • . matches '*atob(?0x*'
        • any of .scan.strings.strings where:
          • . matches "*'at'+'ob'*"
        • any of .scan.javascript.identifiers where:
          • . matches '*ato\\u0062*'
        • any of .scan.strings.strings where:
          • . matches '*document*insertAdjacentHTML*atob*'
  3. not:
    • any of attachments where:
      • .content_type in ('message/global-delivery-status', 'message/delivery-status')
  4. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, regex.icontains, strings.ilike, strings.like. Reference lists: $file_extensions_common_archives, $high_trust_sender_root_domains.

Indicators matched (21)

FieldMatchValue
attachments[].file_extensionmemberhtml
attachments[].file_extensionmemberhtm
attachments[].file_extensionmembershtml
attachments[].file_extensionmemberdhtml
attachments[].file_extensionmembereml
attachments[].file_typeequalshtml
attachments[].content_typeequalsmessage/rfc822
strings.likesubstringdocument
strings.likesubstringwrite
strings.likesubstringatob
regex.icontainsregexdocument.{0,10}write.{0,10}atob
regex.icontainsregex=.?atob.*;
9 more
strings.ilikesubstring*atob?atob*
strings.ilikesubstring*{src: atob*
strings.ilikesubstring*eval?atob*
strings.ilikesubstring*atob(?0x*
strings.ilikesubstring*'at'+'ob'*
strings.ilikesubstring*ato\u0062*
strings.ilikesubstring*document*insertAdjacentHTML*atob*
attachments[].content_typemembermessage/global-delivery-status
attachments[].content_typemembermessage/delivery-status