High Severity
Attachment: Archive containing HTML file with file scheme link
Description
Attached archive contains an HTLM file with a file:// link, likely pointing to an SMB server. This technique can be used to steal NTLM hashes of users who open the HTML file. Known technique of TA577.
Sublime Security
Created Mar 7th, 2024 • Last updated Mar 7th, 2024
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
.file_extension in $file_extensions_common_archives
and any(file.explode(.),
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .flavors.mime == "text/html"
or any(.flavors.yara, . == "html_file")
)
and any(.scan.url.urls, .scheme == "file")
)
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_false_positives
)
)
Playground
Test against your own EMLs or sample data.