Detection rules › Sublime MQL
Attachment: HTML smuggling 'body onload' linking to suspicious destination
Potential HTML Smuggling. This rule inspects HTML attachments that contain a single link and leveraging an HTML body onload event. The linked domain must be in the URLhaus trusted repoters list, or have a suspicious TLD.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, HTML smuggling, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml", "xhtml")
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
)
or .file_extension in~ $file_extensions_common_archives
or .file_type == "html"
or .content_type == "text/html"
)
and any(file.explode(.),
not length(.scan.url.invalid_urls) > 0
and length(.scan.url.urls) == 1
and any(.scan.strings.strings,
strings.ilike(., "*body onload*")
)
and (
any(.scan.url.urls,
.domain.root_domain in $abuse_ch_urlhaus_domains_trusted_reporters
// To-do uncomment below when list is created
// or .domain.root_domain in $suspicious_root_domains
or .domain.tld in $suspicious_tlds
)
)
)
)
Detection logic
Scope: inbound message.
Potential HTML Smuggling. This rule inspects HTML attachments that contain a single link and leveraging an HTML body onload event. The linked domain must be in the URLhaus trusted repoters list, or have a suspicious TLD.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('html', 'htm', 'shtml', 'dhtml', 'xhtml')
all of:
- .file_extension is missing
- .file_type is 'unknown'
- .content_type is 'application/octet-stream'
- .file_extension in $file_extensions_common_archives
- .file_type is 'html'
- .content_type is 'text/html'
any of
file.explode(.)where all hold:not:
- length(.scan.url.invalid_urls) > 0
- length(.scan.url.urls) is 1
any of
.scan.strings.stringswhere:- . matches '*body onload*'
any of
.scan.url.urlswhere any holds:- .domain.root_domain in $abuse_ch_urlhaus_domains_trusted_reporters
- .domain.tld in $suspicious_tlds
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, strings.ilike. Reference lists: $abuse_ch_urlhaus_domains_trusted_reporters, $file_extensions_common_archives, $suspicious_tlds.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_extension | member | xhtml |
attachments[].file_type | equals | unknown |
attachments[].content_type | equals | application/octet-stream |
attachments[].file_type | equals | html |
attachments[].content_type | equals | text/html |
strings.ilike | substring | *body onload* |