Sublime Security high experimental mql

Attachment: Gzip-archived with nested HTML file containing image and button link

Flags messages containing a gzip attachment that unpacks to an HTML file (identified via YARA), or messages whose body contains a base64-encoded image alongside an anchor tag styled as a rounded button, where the link's underlying domain resolves to a valid address. This pattern is commonly used to disguise phishing content and evade detection by embedding the malicious link within an image-styled button or compressed HTML payload.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_type == "gz"),
        any(file.explode(.),
            any(.flavors.yara, . == "html_file")
            and strings.icontains(.scan.strings.raw, "data:image")
            and any(html.xpath(strings.parse_html(.scan.strings.raw),
                               '//a[.//span[contains(@style,"border-radius")]]/@href'
                    ).nodes,
                    strings.parse_url(.raw).domain.valid
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...