
Summary
This rule is designed to detect HTML smuggling techniques that utilize the JavaScript `atob` function, which decodes data encoded in base64 format. The detection occurs by recursively scanning attachments and their contents, looking for specific file types associated with potential HTML smuggling, such as `.html`, `.htm`, various archive file types, and specific content types. The rule applies various filters to identify high entropy files, which are likely to be obfuscated or encoded data, and checks for the presence of specific JavaScript identifiers and patterns indicating the use of `atob`. Additionally, it incorporates conditions to exclude messages marked as delivery status or from highly trusted domains unless they fail DMARC checks, reducing false positives from legitimate sources. The overall goal is to identify potentially malicious content that could be used for phishing or malware delivery through HTML smuggling.
Categories
- Endpoint
- Web
- Cloud
- Linux
- Windows
Data Sources
- File
- Application Log
- Network Traffic
- Process
Created: 2022-06-10