Detection rules › Sublime MQL
Attachment: HTML smuggling with ROT13
Potential HTML obfuscation attack based on suspicious JavaScript identifiers. Some attackers may use obfuscation techniques such as ROT13 to bypass email security filters. This rule may be expanded to inspect HTML attachments for other suspicious identifiers.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Encryption, Evasion, HTML smuggling, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_extension in~ $file_extensions_common_archives
or .file_type in~ ("html", "svg")
)
and any(file.explode(.),
1 of (
any(.scan.javascript.identifiers,
. in~ ("rot13", "decodeROT13")
),
any(.scan.strings.strings,
// ROT13 encoded value for https & http
strings.icontains(., "\"uggcf://")
or strings.icontains(., "\"uggc://")
)
)
and length(.scan.javascript.identifiers) < 100
)
)
Detection logic
Scope: inbound message.
Potential HTML obfuscation attack based on suspicious JavaScript identifiers. Some attackers may use obfuscation techniques such as ROT13 to bypass email security filters. This rule may be expanded to inspect HTML attachments for other suspicious identifiers.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('html', 'htm', 'shtml', 'dhtml')
- .file_extension in $file_extensions_common_archives
- .file_type in ('html', 'svg')
any of
file.explode(.)where all hold:at least 1 of:
any of
.scan.javascript.identifierswhere:- . in ('rot13', 'decodeROT13')
any of
.scan.strings.stringswhere any holds:- . contains '\\"uggcf://'
- . contains '\\"uggc://'
- length(.scan.javascript.identifiers) < 100
Inspects: attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, strings.icontains. Reference lists: $file_extensions_common_archives.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_type | member | html |
attachments[].file_type | member | svg |
file.explode(attachments[])[].scan.javascript.identifiers[] | member | rot13 |
file.explode(attachments[])[].scan.javascript.identifiers[] | member | decodeROT13 |
strings.icontains | substring | \"uggcf:// |
strings.icontains | substring | \"uggc:// |