High Severity
HTML smuggling with atob in message body
Description
Detects if the email body HTML contains the document write or insertAdjacentHTML method and atob function call. This technique has been observed leading to credential phishing.
References
No references.
Sublime Security
Created Aug 17th, 2023 • Last updated Aug 17th, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and (length(body.plain.raw) < 200 or body.plain.raw is null)
and regex.icontains(body.html.raw, "document.{0,10}(write|insertAdjacentHTML).{0,10}atob")
Playground
Test against your own EMLs or sample data.