High Severity
Attachment: HTML smuggling with ROT13
Description
Potential HTML obfuscation attack based on suspicious JavaScript identifiers. Some attackers may use obfuscation techniques such as ROT13 to bypass email security filters. This rule may be expanded to inspect HTML attachments for other suspicious identifiers.
References
No references.
@Kyle_Parrish_
Created Aug 17th, 2023 • Last updated Aug 21st, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_extension in~ $file_extensions_common_archives
or .file_type == "html"
)
and any(file.explode(.),
any(.scan.javascript.identifiers, . in~ ("rot13"))
and length(.scan.javascript.identifiers) < 100
)
)
Playground
Test against your own EMLs or sample data.