Browse Rules

Attachment: HTML smuggling with auto-downloaded file

HTML attachments containing files that are automatically downloaded with Javascript.

Attachment: HTML smuggling with setTimeout

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML attachment with Javascript location

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with unescape

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with eval and atob

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: EML file with HTML attachment (unsolicited)

Detects HTML files in EML attachments from unsolicited senders. Reduces attack surface against HTML smuggling.

Attachment: HTML smuggling with concatenation obfuscation

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with fromCharCode and other signals

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with atob and high entropy

Recursively scans files and archives to detect HTML smuggling techniques using Javascript atob functions.

Attachment: HTML smuggling with hex strings

Recursively scans files and archives to detect HTML smuggling using hex-encoded string content.

Attachment: HTML smuggling with high entropy and other signals

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with embedded base64-encoded executable

HTML attachmemt contains a base-64 encoded executable.

Attachment: HTML smuggling Microsoft sign in

Scans HTML files to detect HTML smuggling techniques impersonating a Microsoft login page.

Attachment: EML file contains HTML attachment with login portal indicators

Attached EML file contains an HTML attachment with suspicious login indicators. Known credential theft technique.

Attachment: HTML smuggling 'body onload' with high entropy and suspicious text

Potential HTML Smuggling. This rule inspects HTML attachments that contain "body unload", high entropy, and suspicious text.

Attachment: HTML smuggling with embedded base64-encoded ISO

HTML attachment contains a base-64 encoded ISO. This is a known TTP for multiple threat actors.

Attachment: HTML smuggling with RC4 decryption

Potential HTML smuggling. The RC4 algorithm is used within inline JavaScript to decrypt the payload on-the-fly.

Attachment: HTML smuggling with atob and high entropy via calendar invite

Scans calendar invites (.ics files) to detect HTML smuggling techniques.

Attachment: HTML smuggling with excessive line break obfuscation

Credential Phishing attacks have been observed using excessive line breaks to obfuscate javascript functions within html files.

Attachment: HTML file with reference to recipient and suspicious patterns

Attached HTML file (or HTML file within an attached email) contains references to the recipients email address, indicative of credential phishing, and suspicious Javascript patterns.

Attachment: Double base64-encoded zip file in HTML smuggling attachment

Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content.

Attachment: HTML smuggling with eval and atob via calendar invite

Scans calendar invites (.ics files) to detect HTML smuggling techniques.

Attachment: Any HTML file (unsolicited)

Potential HTML smuggling attacks in unsolicited messages. Use if passing HTML files is not normal behavior in your environment. This rule may be expanded to inspect HTML attachments for suspicious code.

Attachment: HTML smuggling 'body onload' linking to suspicious destination

Potential HTML Smuggling. This rule inspects HTML attachments that contain a single link and leveraging an HTML body onload event. The linked domain must be in the URLhaus trusted repoters list, or have a suspicious TLD.

Attachment: HTML attachment with login portal indicators

Recursively scans files and archives to detect indicators of login portals implemented in HTML files. This is a known credential theft technique used by threat actors.