• Sublime Core Feed
Medium Severity

Attachment: Any HTML file (untrusted sender)

Labels

Description

Potential HTML smuggling attacks from new senders.

Use if passing HTML files is not normal behavior in your environment.

This rule may be expanded to inspect HTML attachments for suspicious code.

References

Sublime Security
Created Aug 17th, 2023 • Last updated Jan 23rd, 2024
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments, .file_extension in~ ('htm', 'html') or .file_type == "html")
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_false_positives

// negate highly trusted sender domains unless they fail DMARC authentication
and
(
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*fail")
      )
    )
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started