Browse Rules

Attachment: HTML smuggling with unescape

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with concatenation obfuscation

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with high entropy and other signals

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with setTimeout

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with eval and atob

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with eval and atob via calendar invite

Scans calendar invites (.ics files) to detect HTML smuggling techniques.

Attachment: HTML smuggling with fromCharCode and other signals

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with hex strings

Recursively scans files and archives to detect HTML smuggling using hex-encoded string content.

Attachment: HTML smuggling with embedded base64-encoded executable

HTML attachmemt contains a base-64 encoded executable.

Attachment: HTML smuggling with atob and high entropy via calendar invite

Scans calendar invites (.ics files) to detect HTML smuggling techniques.

Attachment: HTML smuggling 'body onload' with high entropy and suspicious text

Potential HTML Smuggling. This rule inspects HTML attachments that contain "body unload", high entropy, and suspicious text.

Attachment: HTML smuggling with raw array buffer

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with atob and high entropy

Recursively scans files and archives to detect HTML smuggling techniques using Javascript atob functions.

Attachment: HTML smuggling with RC4 decryption

Potential HTML smuggling. The RC4 algorithm is used within inline JavaScript to decrypt the payload on-the-fly.

Attachment: HTML smuggling Microsoft sign in

Scans HTML files to detect HTML smuggling techniques impersonating a Microsoft login page.

Attachment: HTML attachment with Javascript location

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with decimal encoding

Potential HTML smuggling attack based on large blocks of decimal encoding. Attackers often use decimal encoding as an obfuscation technique to bypass traditional email security measures.

Attachment: Double base64-encoded zip file in HTML smuggling attachment

Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content.

Attachment: EML file with HTML attachment (unsolicited)

Detects HTML files in EML attachments from unsolicited senders. Reduces attack surface against HTML smuggling.

Attachment: HTML smuggling with auto-downloaded file

HTML attachments containing files that are automatically downloaded with Javascript.

Attachment: Any HTML file (untrusted sender)

Potential HTML smuggling attacks from new senders. Use if passing HTML files is not normal behavior in your environment. This rule may be expanded to inspect HTML attachments for suspicious code.

Attachment: Any HTML file (unsolicited)

Potential HTML smuggling attacks in unsolicited messages. Use if passing HTML files is not normal behavior in your environment. This rule may be expanded to inspect HTML attachments for suspicious code.

Attachment: HTML smuggling 'body onload' linking to suspicious destination

Potential HTML Smuggling. This rule inspects HTML attachments that contain a single link and leveraging an HTML body onload event. The linked domain must be in the URLhaus trusted repoters list, or have a suspicious TLD.

HTML smuggling containing recipient email address

HTML attachment (or HTML attachment in attached email) is small and contains a recipients email address.

Attachment: HTML smuggling with excessive string concatenation and suspicious patterns

Attached HTML file contains excessive string concatenation, a recipient's email address, and an indicator of HTML smuggling. This pattern has been seen in the wild in an attempt to obfuscate the file's contents.