sublimemediumRule

Attachment: GZ archive with credential theft content

Detects inbound messages containing a .gz attachment that, when exploded, contains an email or HTML file. The rule then inspects the inner content for credential theft intent—either by parsing a well-formed embedded EML and running NLU classification on the message body, or, if the EML is malformed, by extracting HTML content, pulling href links, and running link analysis plus NLU classification on the resulting page text to identify high-confidence credential theft indicators.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(filter(attachments, .file_type == "gz"),
        // archive contains an email or an html payload
        any(file.explode(.),
            any(.flavors.yara, . in ("email_file", "html_file"))
        )
        and (
          // well-formed inner eml, NLU on parsed body
          any(file.expand_archives(.).files,
              any(ml.nlu_classifier(file.parse_eml(.).body.current_thread.text).intents,
                  .name == "cred_theft" and .confidence == "high"
              )
          )
          // malformed inner eml, byte-scan html + link_analysis
          or any(filter(file.explode(.), any(.flavors.yara, . == "html_file")),
                 any(html.xpath(strings.parse_html(.scan.strings.raw),
                                '//a/@href'
                     ).nodes,
                     any(ml.nlu_classifier(ml.link_analysis(strings.parse_url(.raw
                                                            )
                                           ).final_dom.inner_text
                         ).intents,
                         .name == "cred_theft" and .confidence == "high"
                     )
                 )
          )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Attachment: GZ archive with credential theft content"
description: "Detects inbound messages containing a .gz attachment that, when exploded, contains an email or HTML file. The rule then inspects the inner content for credential theft intent—either by parsing a well-formed embedded EML and running NLU classification on the message body, or, if the EML is malformed, by extracting HTML content, pulling href links, and running link analysis plus NLU classification on the resulting page text to identify high-confidence credential theft indicators."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(filter(attachments, .file_type == "gz"),
          // archive contains an email or an html payload
          any(file.explode(.),
              any(.flavors.yara, . in ("email_file", "html_file"))
          )
          and (
            // well-formed inner eml, NLU on parsed body
            any(file.expand_archives(.).files,
                any(ml.nlu_classifier(file.parse_eml(.).body.current_thread.text).intents,
                    .name == "cred_theft" and .confidence == "high"
                )
            )
            // malformed inner eml, byte-scan html + link_analysis
            or any(filter(file.explode(.), any(.flavors.yara, . == "html_file")),
                   any(html.xpath(strings.parse_html(.scan.strings.raw),
                                  '//a/@href'
                       ).nodes,
                       any(ml.nlu_classifier(ml.link_analysis(strings.parse_url(.raw
                                                              )
                                             ).final_dom.inner_text
                           ).intents,
                           .name == "cred_theft" and .confidence == "high"
                       )
                   )
            )
          )
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "Archive analysis"
  - "File analysis"
  - "YARA"
  - "Natural Language Understanding"
  - "HTML analysis"
  - "URL analysis"
id: "12d6194a-aeb6-5e92-8559-17464a47d0ea"