Detection rules › Sublime MQL
Attachment: HTML smuggling with base64 encoded ZIP file
Detects HTML attachments containing base64-encoded ZIP or Office files alongside JavaScript decoding functions such as atob, fromCharCode, or base64. This technique is commonly used to evade security controls by hiding malicious files within HTML content that are decoded and executed client-side.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, HTML smuggling, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_type == "html"
)
and (
// javascript functions to decode the base64
strings.icontains(file.parse_text(.).text, 'atob')
or strings.icontains(file.parse_text(.).text, 'fromCharCode')
or strings.icontains(file.parse_text(.).text, 'base64')
)
// Magic bytes for a ZIP/Office File that have been base64 encoded
and regex.contains(file.parse_text(.).text,
'[\x2C\x3B\x3A\x22\x27\x28\x7B\x5B\s]UEsDB'
)
// negation of Micro Focus Voltage Secure Messaging
and not strings.contains(file.parse_text(.).text,
"<input type=\"hidden\" name=\"ZFRdata\" value=\"\n-----BEGIN VOLTAGE SECURE BLOCK V3-----\nUEsDBBQAAAAAAAAAAA"
)
)
Detection logic
Scope: inbound message.
Detects HTML attachments containing base64-encoded ZIP or Office files alongside JavaScript decoding functions such as atob, fromCharCode, or base64. This technique is commonly used to evade security controls by hiding malicious files within HTML content that are decoded and executed client-side.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('html', 'htm', 'shtml', 'dhtml')
- .file_type is 'html'
any of:
- file.parse_text(.).text contains 'atob'
- file.parse_text(.).text contains 'fromCharCode'
- file.parse_text(.).text contains 'base64'
- file.parse_text(.).text matches '[\\x2C\\x3B\\x3A\\x22\\x27\\x28\\x7B\\x5B\\s]UEsDB'
not:
- file.parse_text(.).text contains '<input type=\\"hidden\\" name=\\"ZFRdata\\" value=\\"\\n-----BEGIN VOLTAGE SECURE BLOCK V3-----\\nUEsDBBQAAAAAAAAAAA'
Inspects: attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.parse_text, regex.contains, strings.contains, strings.icontains.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_type | equals | html |
strings.icontains | substring | atob |
strings.icontains | substring | fromCharCode |
strings.icontains | substring | base64 |
regex.contains | regex | [\x2C\x3B\x3A\x22\x27\x28\x7B\x5B\s]UEsDB |
strings.contains | substring | <input type=\"hidden\" name=\"ZFRdata\" value=\"\n-----BEGIN VOLTAGE SECURE BLOCK V3-----\nUEsDBBQAAAAAAAAAAA |