Detection rules › Sublime MQL
Attachment: HTML smuggling 'body onload' with high entropy and suspicious text
Potential HTML Smuggling. This rule inspects HTML attachments that contain "body unload", high entropy, and suspicious text.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, HTML smuggling, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml", "xhtml")
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
)
or .file_extension in~ $file_extensions_common_archives
or .file_type == "html"
or .content_type == "text/html"
)
and any(file.explode(.),
.scan.entropy.entropy >= 5
and any(.scan.strings.strings,
strings.ilike(., "*body onload*")
)
and any(.scan.strings.strings,
regex.icontains(., 'data:image/.*;base64')
)
and any(.scan.strings.strings,
strings.ilike(., "*document pass*")
)
)
)
Detection logic
Scope: inbound message.
Potential HTML Smuggling. This rule inspects HTML attachments that contain "body unload", high entropy, and suspicious text.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('html', 'htm', 'shtml', 'dhtml', 'xhtml')
all of:
- .file_extension is missing
- .file_type is 'unknown'
- .content_type is 'application/octet-stream'
- .file_extension in $file_extensions_common_archives
- .file_type is 'html'
- .content_type is 'text/html'
any of
file.explode(.)where all hold:- .scan.entropy.entropy ≥ 5
any of
.scan.strings.stringswhere:- . matches '*body onload*'
any of
.scan.strings.stringswhere:- . matches 'data:image/.*;base64'
any of
.scan.strings.stringswhere:- . matches '*document pass*'
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, regex.icontains, strings.ilike. Reference lists: $file_extensions_common_archives.
Indicators matched (12)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_extension | member | xhtml |
attachments[].file_type | equals | unknown |
attachments[].content_type | equals | application/octet-stream |
attachments[].file_type | equals | html |
attachments[].content_type | equals | text/html |
strings.ilike | substring | *body onload* |
regex.icontains | regex | data:image/.*;base64 |
strings.ilike | substring | *document pass* |