sublimemediumRule

Attachment: Embedded VBScript in MHT file (unsolicited)

MHT files can be used to run VBScript, which can run malicious code.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1036 T1027 T1059

defense-evasionexecution

Detection Query

type.inbound
and any(attachments,
        (
          .file_extension =~ "mht"
          or .file_extension in~ $file_extensions_common_archives
        )

        // ensure there's an mht file (if it's in an archive)
        and any(file.explode(.), .file_extension =~ "mht")
        and any(file.explode(.),
                any(.scan.html.scripts, .language == "VBScript")
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

https://delivr.to/payloads?id=edc7744f-78bc-4c18-9554-58c35ba9aca5

Raw Content

name: "Attachment: Embedded VBScript in MHT file (unsolicited)"
description: |
  MHT files can be used to run VBScript, which can run malicious code.
references:
  - "https://delivr.to/payloads?id=edc7744f-78bc-4c18-9554-58c35ba9aca5"
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          (
            .file_extension =~ "mht"
            or .file_extension in~ $file_extensions_common_archives
          )
  
          // ensure there's an mht file (if it's in an archive)
          and any(file.explode(.), .file_extension =~ "mht")
          and any(file.explode(.),
                  any(.scan.html.scripts, .language == "VBScript")
          )
  )
  and (
    not profile.by_sender().solicited
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
  - "Scripting"
detection_methods:
  - "Archive analysis"
  - "File analysis"
  - "HTML analysis"
  - "Sender analysis"
id: "b30353a6-773e-5b6d-9252-751b5bc95799"