High Severity
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts
Description
Detects messages with HTML attachments containing multiple 'const' declarations while excluding legitimate Gmail messages. This is evidence of potential code injection or obfuscation techniques.
References
No references.
Sublime Security
Created Feb 3rd, 2025 • Last updated Feb 3rd, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_type == "html"
)
and strings.count(file.parse_html(.).raw, 'const') >= 7
and not regex.contains(file.parse_html(.).raw,
"<!-- saved from url=.{0,7}https://mail.google.com/mail/u/0/#inbox/"
)
and length(file.parse_html(.).raw) < 50000
// long timeouts
and regex.icontains(file.parse_html(.).raw,
'setTimeout\(\s*(?:function\s*)?\(.*?\)\s*(?:=>\s*)?\{[\s\S]*?\},\s*\d+\);',
// const delay = new Promise((resolve) => setTimeout(resolve, 100));
'setTimeout\(\s*\w+\,\s*\d{3,}\)+;'
)
)
// and the sender is not from high trust sender root domains
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Playground
Test against your own EMLs or sample data.