Attachment: HTML smuggling with auto-downloaded file

name: "Attachment: HTML smuggling with auto-downloaded file"
description: |
  HTML attachments containing files that are automatically downloaded with Javascript.
references:
  - "https://delivr.to/payloads?id=40f2f908-b7ea-4dc8-9b72-4280c9005fdd"
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(attachments,
          (
            .file_extension in~ ("html", "htm", "shtml", "dhtml")
            or .file_extension in~ $file_extensions_common_archives
            or .file_type == "html"
          )
          and any(file.explode(.),
                  any(.scan.javascript.identifiers, strings.ilike(., 'click'))
                  and any(.scan.javascript.identifiers,
                          strings.ilike(., 'addEventListener')
                  )
                  and (
                    length(filter(.scan.javascript.identifiers,
                                  strings.like(., "document", "write", "atob")
                           )
                    ) == 3
                    // usage: document['write'](atob)
                    or any(.scan.strings.strings,
                           strings.ilike(., "*document*write*atob*")
                    )
                    // usage: some_var = atob();
                    or any(.scan.strings.strings, strings.ilike(., "*=*atob*;"))
                    // usage: obfuscating "atob"
                    or any(.scan.javascript.identifiers,
                           strings.ilike(., '*ato\u0062*')
                    )
                    // usage: document.head.insertAdjacentHTML("beforeend", atob(...
                    or any(.scan.strings.strings,
                           strings.ilike(.,
                                         "*document*write*atob*",
                                         "*document*insertAdjacentHTML*atob*"
                           )
                    )
                  )
          )
  )
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "HTML smuggling"
  - "Scripting"
detection_methods:
  - "Archive analysis"
  - "Content analysis"
  - "File analysis"
  - "HTML analysis"
  - "Javascript analysis"
  - "Sender analysis"
  - "URL analysis"
id: "abf724f5-d59e-546c-aec2-3f1bc0e2f14b"