sublimehighRule

Attachment: Fake Zoom installer

HTML attachment contains a Zoom logo, request language, and a link to an executable. Observed in the wild.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1036 T1027 T1566.002 T1598.003 T1059 T1566 T1598

defense-evasioninitial-accessexecution

Detection Query

type.inbound
and any(attachments,
        (
          .file_extension in~ ("html", "htm", "shtml", "dhtml")
          or .file_type == "html"
          or .content_type == "text/html"
        )
        and any(ml.logo_detect(file.html_screenshot(.)).brands,
                .name == "Zoom" and .confidence in ("medium", "high")
        )
        and any(ml.nlu_classifier(file.parse_html(.).display_text).entities,
                .name == "request" and .text =~ "download"
        )
        and any(file.explode(.),
                any(.scan.url.urls,
                    strings.iends_with(.path, ".exe")
                    and .domain.root_domain not in $org_domains
                )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Fake Zoom installer"
description: |
  HTML attachment contains a Zoom logo, request language, and a link to an executable. Observed in the wild.
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(attachments,
          (
            .file_extension in~ ("html", "htm", "shtml", "dhtml")
            or .file_type == "html"
            or .content_type == "text/html"
          )
          and any(ml.logo_detect(file.html_screenshot(.)).brands,
                  .name == "Zoom" and .confidence in ("medium", "high")
          )
          and any(ml.nlu_classifier(file.parse_html(.).display_text).entities,
                  .name == "request" and .text =~ "download"
          )
          and any(file.explode(.),
                  any(.scan.url.urls,
                      strings.iends_with(.path, ".exe")
                      and .domain.root_domain not in $org_domains
                  )
          )
  )
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
  - "HTML smuggling"
  - "Impersonation: Brand"
  - "Scripting"
  - "Social engineering"
detection_methods:
  - "Archive analysis"
  - "Computer Vision"
  - "File analysis"
  - "HTML analysis"
  - "Natural Language Understanding"
  - "URL analysis"
id: "840a12a6-a796-5e73-b975-1d1b5f745aea"