High Severity

Attachment: HTML with JavaScript functions for HTTP requests

Labels

Credential Phishing

Evasion

Description

This rule identifies HTML attachments which contain multiple references to JavaScript functions that support making HTTP requests. This has been observed in phishing campaigns to load remote payloads into otherwise benign HTML attachments.

References

No references.

Sublime Security

Created Jul 3rd, 2024 • Last updated Aug 5th, 2025

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and not profile.by_sender().solicited
// not high trust sender domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and any(attachments,
        .file_extension in~ ("html", "htm", "shtml", "dhtml")
        and 3 of (
          strings.icontains(file.parse_html(.).raw, '.replace'),
          strings.icontains(file.parse_html(.).raw, 'XMLHttpRequest'),
          strings.icontains(file.parse_html(.).raw, 'onreadystate'),
          strings.icontains(file.parse_html(.).raw, 'GET'),
          strings.icontains(file.parse_html(.).raw, 'send()'),
          strings.icontains(file.parse_html(.).raw, 'responseText'),
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.