detection.wiki

Detection rules › Sublime MQL

HTML smuggling with atob in message body

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects if the email body HTML contains the document write or insertAdjacentHTML method and atob function call. This technique has been observed leading to credential phishing.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesHTML smuggling

Event coverage

Message attribute
body.html
body.plain
type

Rule body MQL

type.inbound
and (length(body.plain.raw) < 200 or body.plain.raw is null)
and regex.icontains(body.html.raw,
                    "document.{0,10}(write|insertAdjacentHTML).{0,10}atob"
)

Detection logic

Scope: inbound message.

Detects if the email body HTML contains the document write or insertAdjacentHTML method and atob function call. This technique has been observed leading to credential phishing.

  1. inbound message
  2. any of:
    • length(body.plain.raw) < 200
    • body.plain.raw is missing
  3. body.html.raw matches 'document.{0,10}(write|insertAdjacentHTML).{0,10}atob'

Inspects: body.html.raw, body.plain.raw, type.inbound. Sensors: regex.icontains.

Indicators matched (1)

FieldMatchValue
regex.icontainsregexdocument.{0,10}(write|insertAdjacentHTML).{0,10}atob