Low Severity
Attachment: Any HTML file (unsolicited)
Labels
Description
Potential HTML smuggling attacks in unsolicited messages.
Use if passing HTML files is not normal behavior in your environment.
This rule may be expanded to inspect HTML attachments for suspicious code.
References
Sublime Security
Created Aug 17th, 2023 • Last updated Nov 14th, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments, .file_extension in~ ('htm', 'html') or .file_type == "html")
and (
not profile.by_sender().solicited
or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_false_positives
// negate highly trusted sender domains unless they fail DMARC authentication
and
(
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and (
any(distinct(headers.hops, .authentication_results.dmarc is not null),
strings.ilike(.authentication_results.dmarc, "*fail")
)
)
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Playground
Test against your own EMLs or sample data.