sublimemediumRule

Attachment: HTML smuggling with dynamically constructed redirect URL

Detects HTML attachments, including those nested inside forwarded EML files, that contain obfuscated JavaScript designed to dynamically assemble a redirect URL at runtime rather than embedding it directly in the markup. The script typically builds an empty route via route.join, sets an image or iframe src from a url/protocol variable, and defines a host string separately, a pattern used to evade static URL scanning before sending the recipient to a credential phishing page.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027 T1598.003 T1059

defense-evasioninitial-accessexecution

Detection Query

type.inbound
and any(attachments,
        (
          .file_type == "html"
          and 2 of (
            regex.icontains(file.parse_html(.).raw,
                            'route\.join\(\s*["'']{2}\s*\)'
            ),
            regex.icontains(file.parse_html(.).raw,
                            '\.src\s*=\s*(?:url|protocol)'
            ),
            regex.icontains(file.parse_html(.).raw, 'const\s+host\s*=\s*["'']')
          )
        )
        or (
          (.file_extension == "eml" or .content_type == "message/rfc822")
          and any(file.parse_eml(.).attachments,
                  .file_type == "html"
                  and 2 of (
                    regex.icontains(file.parse_html(.).raw,
                                    'route\.join\(\s*["'']{2}\s*\)'
                    ),
                    regex.icontains(file.parse_html(.).raw,
                                    '\.src\s*=\s*(?:url|protocol)'
                    ),
                    regex.icontains(file.parse_html(.).raw,
                                    'const\s+host\s*=\s*["'']'
                    )
                  )
          )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: HTML smuggling with dynamically constructed redirect URL"
description: "Detects HTML attachments, including those nested inside forwarded EML files, that contain obfuscated JavaScript designed to dynamically assemble a redirect URL at runtime rather than embedding it directly in the markup. The script typically builds an empty route via route.join, sets an image or iframe src from a url/protocol variable, and defines a host string separately, a pattern used to evade static URL scanning before sending the recipient to a credential phishing page."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          (
            .file_type == "html"
            and 2 of (
              regex.icontains(file.parse_html(.).raw,
                              'route\.join\(\s*["'']{2}\s*\)'
              ),
              regex.icontains(file.parse_html(.).raw,
                              '\.src\s*=\s*(?:url|protocol)'
              ),
              regex.icontains(file.parse_html(.).raw, 'const\s+host\s*=\s*["'']')
            )
          )
          or (
            (.file_extension == "eml" or .content_type == "message/rfc822")
            and any(file.parse_eml(.).attachments,
                    .file_type == "html"
                    and 2 of (
                      regex.icontains(file.parse_html(.).raw,
                                      'route\.join\(\s*["'']{2}\s*\)'
                      ),
                      regex.icontains(file.parse_html(.).raw,
                                      '\.src\s*=\s*(?:url|protocol)'
                      ),
                      regex.icontains(file.parse_html(.).raw,
                                      'const\s+host\s*=\s*["'']'
                      )
                    )
            )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "HTML smuggling"
  - "Evasion"
  - "Impersonation: Brand"
  - "Social engineering"
  - "Scripting"
detection_methods:
  - "HTML analysis"
  - "Javascript analysis"
  - "File analysis"
id: "78cda2f4-d648-5919-b83d-62f48ba7e1cc"