sublimehighRule

Attachment: Gzip-archived with nested HTML file containing image and button link

Flags messages containing a gzip attachment that unpacks to an HTML file (identified via YARA), or messages whose body contains a base64-encoded image alongside an anchor tag styled as a rounded button, where the link's underlying domain resolves to a valid address. This pattern is commonly used to disguise phishing content and evade detection by embedding the malicious link within an image-styled button or compressed HTML payload.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(filter(attachments, .file_type == "gz"),
        any(file.explode(.),
            any(.flavors.yara, . == "html_file")
            and strings.icontains(.scan.strings.raw, "data:image")
            and any(html.xpath(strings.parse_html(.scan.strings.raw),
                               '//a[.//span[contains(@style,"border-radius")]]/@href'
                    ).nodes,
                    strings.parse_url(.raw).domain.valid
            )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Gzip-archived with nested HTML file containing image and button link"
description: "Flags messages containing a gzip attachment that unpacks to an HTML file (identified via YARA), or messages whose body contains a base64-encoded image alongside an anchor tag styled as a rounded button, where the link's underlying domain resolves to a valid address. This pattern is commonly used to disguise phishing content and evade detection by embedding the malicious link within an image-styled button or compressed HTML payload."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(filter(attachments, .file_type == "gz"),
          any(file.explode(.),
              any(.flavors.yara, . == "html_file")
              and strings.icontains(.scan.strings.raw, "data:image")
              and any(html.xpath(strings.parse_html(.scan.strings.raw),
                                 '//a[.//span[contains(@style,"border-radius")]]/@href'
                      ).nodes,
                      strings.parse_url(.raw).domain.valid
              )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "HTML smuggling"
  - "Image as content"
  - "Evasion"
detection_methods:
  - "Archive analysis"
  - "YARA"
  - "HTML analysis"
  - "URL analysis"
  - "File analysis"
id: "c9bd6835-abd4-5430-8a5f-c845e3b5b3f6"