Sublime Security medium experimental mql

Attachment: Any HTML file within archive (unsolicited)

Recursively scans archives to detect HTML files from unsolicited senders. HTML files can be used for HTML smuggling and embedded in archives to evade detection.

View Source

Detection Logic

type.inbound
and any(attachments,
        .file_extension in~ $file_extensions_common_archives
        and any(file.explode(.),
                .depth > 0 and .file_extension in~ ("html", "htm")
        )
)
and (
  not profile.by_sender().solicited
  or (profile.by_sender().any_messages_malicious_or_spam)
)
and not profile.by_sender().any_messages_benign

Field Validations

Loading…

Comments (0)

Loading comments...