Detection rules › Sublime MQL
Attachment: HTML smuggling with base64 encoded JavaScript function
This rule identifies attachments that either have an HTML extension, lack any file extension, or possess an unrecognized file type and are employing Base64 encoding to conceal JavaScript functions within HTML script tags with little to no other content. Such obfuscation tactics have been frequently observed in credential phishing campaigns.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | HTML smuggling, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
and .size < 100000000
)
or .file_extension in~ $file_extensions_common_archives
or .file_type == "html"
)
and any(file.explode(.),
any(.scan.strings.strings,
strings.contains(., "data:text/javascript;base64")
)
// strings array is small
and length(.scan.strings.strings) < 10
)
)
Detection logic
Scope: inbound message.
This rule identifies attachments that either have an HTML extension, lack any file extension, or possess an unrecognized file type and are employing Base64 encoding to conceal JavaScript functions within HTML script tags with little to no other content. Such obfuscation tactics have been frequently observed in credential phishing campaigns.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('html', 'htm', 'shtml', 'dhtml')
all of:
- .file_extension is missing
- .file_type is 'unknown'
- .content_type is 'application/octet-stream'
- .size < 100000000
- .file_extension in $file_extensions_common_archives
- .file_type is 'html'
any of
file.explode(.)where all hold:any of
.scan.strings.stringswhere:- . contains 'data:text/javascript;base64'
- length(.scan.strings.strings) < 10
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, attachments[].size, type.inbound. Sensors: file.explode, strings.contains. Reference lists: $file_extensions_common_archives.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_type | equals | unknown |
attachments[].content_type | equals | application/octet-stream |
attachments[].file_type | equals | html |
strings.contains | substring | data:text/javascript;base64 |