sublimehighRule

Attachment: HTML smuggling with embedded base64-encoded executable

HTML attachmemt contains a base-64 encoded executable.

MITRE ATT&CK

defense-evasion

Detection Query

type.inbound
and any(attachments,
        (
          .file_extension in~ ("html", "htm", "shtml", "dhtml")
          or .file_extension in~ $file_extensions_common_archives
          or .file_type == "html"
        )
        and any(file.explode(.),
                (
                  .file_extension in~ ("html", "htm", "shtml", "dhtml")
                  or .flavors.mime == "text/plain"
                )
                and any(.flavors.yara, . == 'base64_pe')
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

Raw Content

name: "Attachment: HTML smuggling with embedded base64-encoded executable"
description: |
  HTML attachmemt contains a base-64 encoded executable.
references:
  - "https://delivr.to/payloads?id=739e977c-8e8f-4ba8-940a-c53ba77cecca"
  - "https://www.microsoft.com/en-us/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium"
  - "https://sandbox.sublimesecurity.com?id=28fe5e67-2dec-4072-a263-24ee53cc54c3"
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(attachments,
          (
            .file_extension in~ ("html", "htm", "shtml", "dhtml")
            or .file_extension in~ $file_extensions_common_archives
            or .file_type == "html"
          )
          and any(file.explode(.),
                  (
                    .file_extension in~ ("html", "htm", "shtml", "dhtml")
                    or .flavors.mime == "text/plain"
                  )
                  and any(.flavors.yara, . == 'base64_pe')
          )
  )
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
  - "HTML smuggling"
detection_methods:
  - "Archive analysis"
  - "File analysis"
  - "HTML analysis"
  - "YARA"
id: "b00c4527-957c-53ba-9eee-c5ef555b24e3"