Attachment: HTML smuggling with atob and high entropy via calendar invite

name: "Attachment: HTML smuggling with atob and high entropy via calendar invite"
description: "Scans calendar invites (.ics files) to detect HTML smuggling techniques."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(attachments,
          (.file_extension =~ "ics" or .content_type == "text/calendar")
          and any(file.explode(.),
                  .scan.entropy.entropy >= 5
                  and (
                    length(filter(.scan.javascript.identifiers,
                                  strings.like(., "document", "write", "atob")
                           )
                    ) == 3
                    // usage: document['write'](atob)
                    or any(.scan.strings.strings,
                           regex.icontains(., "document.{0,10}write.{0,10}atob")
                    )
                    // usage: some_var = atob();
                    or any(.scan.strings.strings,
                           regex.icontains(., "=.?atob.*;")
                    )
                    // usage: atob(atob
                    or any(.scan.strings.strings, strings.ilike(., "*atob?atob*"))
                    // usage: {src: atob
                    or any(.scan.strings.strings,
                           strings.ilike(., "*{src: atob*")
                    )
                    // usage: eval(atob)
                    or any(.scan.strings.strings, strings.ilike(., "*eval?atob*"))
                    // usage: atob(_0x)
                    or any(.scan.strings.strings, strings.ilike(., "*atob(?0x*"))
                    // usage : 'at'+'ob'
                    or any(.scan.strings.strings, strings.ilike(., "*'at'+'ob'*"))
                    // usage: obfuscating "atob"
                    or any(.scan.javascript.identifiers,
                           strings.ilike(., '*ato\u0062*')
                    )
                    // usage: document.head.insertAdjacentHTML("beforeend", atob(...
                    or any(.scan.strings.strings,
                           strings.ilike(., "*document*insertAdjacentHTML*atob*")
                    )
                  )
          )
  )
  // negate bouncebacks and undeliverables
  and not any(attachments,
              .content_type in (
                "message/global-delivery-status",
                "message/delivery-status"
              )
  )
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not headers.auth_summary.dmarc.pass
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
  - "HTML smuggling"
  - "Scripting"
detection_methods:
  - "File analysis"
  - "HTML analysis"
  - "Javascript analysis"
  - "Sender analysis"
id: "94d84614-6f4a-5554-b30c-4ab67073d564"