detection.wiki

Detection rules › Sublime MQL

Attachment: HTML smuggling with eval and atob via calendar invite

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Scans calendar invites (.ics files) to detect HTML smuggling techniques.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, HTML smuggling, ICS Phishing, Scripting

Event coverage

Message attribute
attachments (collection)
type

Rule body MQL

type.inbound
and any(attachments,
        (.file_extension =~ "ics" or .content_type == "text/calendar")
        // usage: onerror="eval(atob('
        and regex.imatch(file.parse_text(.).text, ".*eval.{1,4}atob.*")
)

Detection logic

Scope: inbound message.

Scans calendar invites (.ics files) to detect HTML smuggling techniques.

  1. inbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension is 'ics'
      • .content_type is 'text/calendar'
    • file.parse_text(.).text matches '.*eval.{1,4}atob.*'

Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: file.parse_text, regex.imatch.

Indicators matched (3)

FieldMatchValue
attachments[].file_extensionequalsics
attachments[].content_typeequalstext/calendar
regex.imatchregex.*eval.{1,4}atob.*