Low Severity

Attachment: HTML file with eval function and long byte string (Unsolicited)

Labels

No labels.

Description

HTML attachment using the eval() JavaScript function with a long string containing byte characters.

@delivr_to
Created Aug 17th, 2023 • Last updated Apr 22nd, 2024
Feed Source
delivr.to Feed
Source
type.inbound
and any(attachments,
  (
    regex.imatch(.file_extension, '^[sdx]{0,1}ht[ml]{0,2}$') or
    .file_extension in~ $file_extensions_common_archives or
    .file_type == "html"
  )
  and any(file.explode(.),
    any(.flavors.yara, . == "javascript_file") and 
    any(.scan.strings.strings, 
      regex.icontains(., "eval") and 
      length(.) > 500 and 
      regex.icontains(., '(.*\\x\w\w.*){20}')
    )
  )
)
and (
  not profile.by_sender_email().solicited
  or sender.email.domain.domain == "delivrto.me"
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started