Browse Rules

Attachment: File execution via Javascript

Javascript contains identifiers or strings that may attempt to execute files.

Attachment: HTML with obfuscation and recipient's email in JavaScript strings

Attached HTML file contains JavaScript code with suspicious identifiers like 'atob' or 'decrypt', as well as the recipient's email address embedded within the JavaScript

Attachment: JavaScript file with suspicious base64-encoded executable

JavaScript attachment or compressed JavaScript file containing a base64 encoded executable.

Attachment: HTML smuggling with auto-downloaded file

HTML attachments containing files that are automatically downloaded with Javascript.

Attachment: HTML attachment with Javascript location

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: Embedded Javascript in SVG file

Javascript inside SVG files can be used to smuggle malicious payloads or execute scripts.

Link: JavaScript obfuscation with Telegram bot integration

Detects links containing obfuscated JavaScript code with embedded Telegram bot tokens or API references, indicating potential data exfiltration or command and control infrastructure.

Attachment: HTML smuggling with atob and high entropy

Recursively scans files and archives to detect HTML smuggling techniques using Javascript atob functions.

Attachment: PDF with embedded Javascript

PDF contains embedded Javascript.

Attachment: HTML with JavaScript functions for HTTP requests

This rule identifies HTML attachments which contain multiple references to JavaScript functions that support making HTTP requests. This has been observed in phishing campaigns to load remote payloads into otherwise benign HTML attachments.

Attachment: HTML smuggling with RC4 decryption

Potential HTML smuggling. The RC4 algorithm is used within inline JavaScript to decrypt the payload on-the-fly.

Attachment: HTML smuggling with excessive line break obfuscation

Credential Phishing attacks have been observed using excessive line breaks to obfuscate javascript functions within html files.

Attachment: PDF with base64 JavaScript and eval functions

PDF attachment contains base64-encoded JavaScript variables with eval functions, indicating potential code obfuscation and execution techniques commonly used in malicious documents.

Attachment: HTML file with reference to recipient and suspicious patterns

Attached HTML file (or HTML file within an attached email) contains references to the recipients email address, indicative of credential phishing, and suspicious Javascript patterns.

Link: Suspicious recipient with timeout redirect

Detects inbound messages sent to self, invalid recipients, or undisclosed recipients containing links that, upon analysis, include a JavaScript setTimeout redirect. This technique delays redirection and appends URL fragments to evade static link inspection.

Attachment: HTML smuggling with base64 encoded JavaScript function

This rule identifies attachments that either have an HTML extension, lack any file extension, or possess an unrecognized file type and are employing Base64 encoding to conceal JavaScript functions within HTML script tags with little to no other content. Such obfuscation tactics have been frequently observed in credential phishing campaigns.

Attachment: HTML smuggling with setTimeout

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: EML with embedded Javascript in SVG file

Detects incoming messages containing EML attachments with embedded SVG files that contain malicious JavaScript code, including base64-encoded content and potentially harmful event handlers. The rule specifically watches for onload events, location redirects, error handlers, and iframe elements with base64 data URIs.

Attachment: HTML smuggling with unescape

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with ROT13

Potential HTML obfuscation attack based on suspicious JavaScript identifiers. Some attackers may use obfuscation techniques such as ROT13 to bypass email security filters. This rule may be expanded to inspect HTML attachments for other suspicious identifiers.

Attachment: ICS with embedded Javascript in SVG file

Detects incoming messages containing ICS attachments with embedded SVG files that contain malicious JavaScript code, including base64-encoded content and potentially harmful event handlers. The rule specifically watches for onload events, location redirects, error handlers, and iframe elements with base64 data URIs.

Attachment: HTML smuggling with eval and atob

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with fromCharCode and other signals

Recursively scans files and archives to detect HTML smuggling techniques.

Attachment: HTML smuggling with hex strings

Recursively scans files and archives to detect HTML smuggling using hex-encoded string content.

Attachment: HTML smuggling with raw array buffer

Recursively scans files and archives to detect HTML smuggling techniques.