Detection rules › Sublime MQL
Attachment: HTML smuggling with excessive line break obfuscation
Credential Phishing attacks have been observed using excessive line breaks to obfuscate javascript functions within html files.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Encryption, Evasion, HTML smuggling, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_extension in~ $file_extensions_common_archives
or .file_type == "html"
)
and any(file.explode(.),
any(.scan.strings.strings,
// return new line padded obfuscation
regex.contains(., '(\\r\\n\S{2}){50,}')
and strings.contains(., 'decodeURIComponent')
)
)
)
Detection logic
Scope: inbound message.
Credential Phishing attacks have been observed using excessive line breaks to obfuscate javascript functions within html files.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('html', 'htm', 'shtml', 'dhtml')
- .file_extension in $file_extensions_common_archives
- .file_type is 'html'
any of
file.explode(.)where:any of
.scan.strings.stringswhere all hold:- . matches '(\\\\r\\\\n\\S{2}){50,}'
- . contains 'decodeURIComponent'
Inspects: attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, regex.contains, strings.contains. Reference lists: $file_extensions_common_archives.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_type | equals | html |
regex.contains | regex | (\\r\\n\S{2}){50,} |
strings.contains | substring | decodeURIComponent |