Attachment: EML file with HTML attachment (unsolicited)

name: "Attachment: EML file with HTML attachment (unsolicited)"
description: |
  Detects HTML files in EML attachments from unsolicited senders.

  Reduces attack surface against HTML smuggling.
type: "rule"
severity: "medium"
source: |
  type.inbound
  
  // has EML attachment
  and any(attachments,
          (.file_extension == "eml" or .content_type == "message/rfc822")
          and any(file.parse_eml(.).attachments,
                  // HTML file inside EML attachment
                  // we've seen files named ".htm.", which results in an empty
                  // .file_extension, so instead we look at .file_name
                  // they should be rare enough in EML attachments to not cause
                  // extraneous FPs
                  strings.ilike(.file_name, "*htm*")
                  or .file_type == "html"
                  or any(file.explode(.), .flavors.mime == "text/html")
          )
  )
  
  // exclude bounce backs & read receipts
  and not strings.like(sender.email.local_part,
                       "*postmaster*",
                       "*mailer-daemon*",
                       "*administrator*"
  )
  and not regex.icontains(subject.subject, "^(undeliverable|read:)")
  and not any(attachments, .content_type == "message/delivery-status")
  // if the "References" is in the body of the message, it's probably a bounce
  and not any(headers.references, strings.contains(body.html.display_text, .))
  // unsolicited or fails authentation
  and (
    (
      profile.by_sender_email().prevalence in ("new", "outlier")
      and not profile.by_sender_email().solicited
    )
    or (
      profile.by_sender_email().any_messages_malicious_or_spam
      and not profile.by_sender_email().any_messages_benign
    )
    or (
      sender.email.domain.domain in $org_domains
      and not coalesce(headers.auth_summary.dmarc.pass, false)
    )
  )
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not coalesce(headers.auth_summary.dmarc.pass, false)
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )

tags:
  - "Attack surface reduction"
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
  - "HTML smuggling"
detection_methods:
  - "Content analysis"
  - "File analysis"
  - "Header analysis"
  - "HTML analysis"
  - "Sender analysis"
id: "c24fd191-1685-5cb8-83ef-618225401332"