• Sublime Core Feed
High Severity

Attachment: HTML smuggling with base64 encoded JavaScript function

Labels

Description

This rule identifies attachments that either have an HTML extension, lack any file extension, or possess an unrecognized file type

and are employing Base64 encoding to conceal JavaScript functions within HTML script tags with little to no other content.

Such obfuscation tactics have been frequently observed in credential phishing campaigns.

References

No references.

Sublime Security
Created Aug 27th, 2023 • Last updated Aug 27th, 2023
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        (
          .file_extension in~ ("html", "htm", "shtml", "dhtml")
          or (
            .file_extension is null
            and .file_type == "unknown"
            and .content_type == "application/octet-stream"
            and .size < 100000000
          )
          or .file_extension in~ $file_extensions_common_archives
          or .file_type == "html"
        )
        and any(file.explode(.),
                any(.scan.strings.strings, strings.contains(., "data:text/javascript;base64"))
                // strings array is small
                and length(.scan.strings.strings) < 10
        )
)

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started