High Severity

Attachment: HTML with JavaScript functions for HTTP requests

Labels

Credential Phishing

Evasion

Description

This rule identifies HTML attachments which contain multiple references to JavaScript functions that support making HTTP requests. This has been observed in phishing campaigns to load remote payloads into otherwise benign HTML attachments.

References

No references.

Sublime Security

Created Jul 3rd, 2024 • Last updated Sep 23rd, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and not profile.by_sender().solicited
// not high trust sender domains
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
and any(attachments,
        .file_extension in~ ("html", "htm", "shtml", "dhtml")
        and 3 of (
          strings.icontains(file.parse_html(.).raw, '.replace'),
          strings.icontains(file.parse_html(.).raw, 'XMLHttpRequest'),
          strings.icontains(file.parse_html(.).raw, 'onreadystate'),
          strings.icontains(file.parse_html(.).raw, 'GET'),
          strings.icontains(file.parse_html(.).raw, 'send()'),
          strings.icontains(file.parse_html(.).raw, 'responseText'),
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.