High Severity
Attachment: HTML smuggling with atob and high entropy via calendar invite
Description
Scans calendar invites (.ics files) to detect HTML smuggling techniques.
References
No references.
Sublime Security
Created Jun 3rd, 2025 • Last updated Jun 3rd, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
(
.file_extension =~ "ics"
or .content_type == "text/calendar"
)
and any(file.explode(.),
.scan.entropy.entropy >= 5
and (
length(filter(.scan.javascript.identifiers,
strings.like(., "document", "write", "atob")
)
) == 3
// usage: document['write'](atob)
or any(.scan.strings.strings, regex.icontains(., "document.{0,10}write.{0,10}atob"))
// usage: some_var = atob();
or any(.scan.strings.strings, regex.icontains(., "=.?atob.*;"))
// usage: atob(atob
or any(.scan.strings.strings, strings.ilike(., "*atob?atob*"))
// usage: {src: atob
or any(.scan.strings.strings, strings.ilike(., "*{src: atob*"))
// usage: eval(atob)
or any(.scan.strings.strings, strings.ilike(., "*eval?atob*"))
// usage: atob(_0x)
or any(.scan.strings.strings, strings.ilike(., "*atob(?0x*"))
// usage : 'at'+'ob'
or any(.scan.strings.strings, strings.ilike(., "*'at'+'ob'*"))
// usage: obfuscating "atob"
or any(.scan.javascript.identifiers, strings.ilike(., '*ato\u0062*'))
// usage: document.head.insertAdjacentHTML("beforeend", atob(...
or any(.scan.strings.strings,
strings.ilike(.,
"*document*insertAdjacentHTML*atob*"
)
)
)
)
)
// negate bouncebacks and undeliverables
and not any(attachments,
.content_type in (
"message/global-delivery-status",
"message/delivery-status"
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Playground
Test against your own EMLs or sample data.