Suspected cross-site scripting (XSS) found in subject

name: "Suspected cross-site scripting (XSS) found in subject"
description: "This rule detects Cross-Site Scripting (XSS) attempts within email subjects. It bypasses messages from highly trusted domains unless they fail authentication. However, the rule remains flexible, triggering even for trusted domains when emails are sent from Google Groups, ensuring thorough protection against potential threats while minimizing false positives."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // subject contains suspected cross site scripting
  and regex.icontains(subject.subject,
                      '(?:[<]|%(25)?3c|\\u003c|\\x3c|&[lg]t;|&n[vw][lg]t;)\/?(?:script(?:\s*/?\s*src\s*=)?|div|iframe|embed|object|style|form|meta|link|svg|img|audio|video|source|body|input|textarea|select|noscript|(?:/|%(25)?2f)?title|(?:/|%(25)?2f)?textarea|(?:/|%(25)?2f)?style|(?:/|%(25)?2f)?template|(?:/|%(25)?2f)?noembed)',
                      // constructor chain pattern
                      'constructor\.constructor|\[\s*constructor\s*\]|\.__proto__|\[constructor\]'
  )
  
  // and contains html or url encoded strings, hex escaped strings, opening or closing html tags, or escaped non word characters
  and // subject contains common event handlers
   regex.icontains(subject.subject,
                   '(?:\b|%[a-f0-9]{2})(?:on(?:abort|blur|change|click|dblclick|error|focus|load|mouse(?:over|out|move|down|up)|key(?:down|up|press)|reset|select|submit|unload)|srcdoc|src\s*(?:=|%(?:25)?3d))',
                   // subject contains javascript funcitons
                   '(?:\b|%(?:25)?[a-f0-9]{2})(?:javascript|eval|settimeout|setinterval|document\.(?:cookie|write|location|createElement|body|appendChild)|fetch|constructor|__proto__|prototype|atob|getScript|script(?:\s|%(?:25)?20)src)(?:\b|%(?:25)?[a-f0-9]{2})',
                   // url encoded forms of script src
                   '(?:\b|%(?:25)?[a-f0-9]{2})script(?:\s|%(?:25)?20)src(?:\b|%(?:25)?[a-f0-9]{2})'
  )
  and regex.icontains(subject.subject,
                      // Pattern 1: Quote followed by various special characters in encoded/literal forms:
                      // - < > angle brackets (%3C, %3E, literal, &lt;, &gt;)
                      // - quotes (&quot;, &apos;)
                      // - parentheses (&lpar;, &rpar;)
                      // - curly braces (&lcub;, &rcub;)
                      // - square brackets (&lsqb;, &rsqb;)
                      // - equals sign (&equals;)
                      // - forward/backward slashes (&sol;, &bsol;)
                      // - colon (&colon;)
                      // - semicolon (&semi;)
                      '[\x27\x22](?:%3[CE]|[<>]|&(?:lt|gt|quot|apos|[lr](?:par|cub|sqb)|equals|[bs]ol|colon|semi)\x3b)',
                      // Pattern 2: Encoded/special characters followed by quote
                      // Same as above but in reverse order - special chars followed by quote
                      '(?:%3[CE]|[<>]|&(?:lt|gt|quot|apos|[lr](?:par|cub|sqb)|equals|[bs]ol|colon|semi)\x3b)[\x27\x22]',
  
                      // Pattern 3: Hexadecimal or decimal HTML entities with semicolon
                      // e.g., &#x27; (hex) or &#39; (decimal)
                      '&#[xX]?[a-f0-9]+;',
  
                      // Pattern 4: Raw decimal HTML entities
                      // e.g., &#60 (without semicolon)
                      '&#\d+',
  
                      // Pattern 5: URL encoded characters
                      // e.g., %3C for <, %3E for >, %22 for ", %27 for '
                      '%[a-f0-9]{2}',
  
                      // Pattern 6: Unicode/hex escapes
                      // e.g., \u003C for <, \x3C for 
                      '\\[xXuU][a-f0-9]{4}',
                      // New patterns for this type of payload
                      '</[^>]+/[^>]+>', // Matches closing tags with slash delimiters
                      '//[^"\x27>\s]+', // Matches protocol-relative URLs
                      'xss\.report', // Specific known XSS domains
                      '/\*|\*/|\-\->', // comment chars (/*, */, -->)
  )
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and (
        any(distinct(headers.hops, .authentication_results.dmarc is not null),
            strings.ilike(.authentication_results.dmarc, "*fail")
        )
        or (
          strings.icontains(sender.display_name, "via")
          and any(headers.hops,
                  any(.fields,
                      .name == "List-ID"
                      and strings.ends_with(.value,
                                            strings.concat(sender.email.domain.domain,
                                                           ">"
                                            )
                      )
                  )
          )
        )
      )
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Scripting"
detection_methods:
  - "Content analysis"
  - "Sender analysis"
id: "8a946cfa-58ea-59c5-9726-94a1892b5556"