Cross-source coverage
T1027.006 / ATT&CK
Obfuscated Files or Information: HTML Smuggling
2 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.
Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes. Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html. Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim (i.e. Deobfuscate/Decode Files or Information), potentially bypassing content filters.
For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as msSaveBlob.
- Tactics
- Stealth
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonEDR:detectionNetwork Trafficauditd:SYSCALLlinux:osquerymacos:unifiedlogmacos:osquerygatekeeper/quarantine database
How MITRE says to detect it DET0313
Detection Strategy for HTML Smuggling via JavaScript Blob + Dynamic File Drop
Windows Analytic 0872
Detection of browser-based or email client-driven file creation (often from temp directories) following navigation to or execution of HTML files containing JavaScript Blob APIs or base64 Data URLs, with follow-on execution of the dropped payload. Leveraging Sysmon EventID 15 to inspect Zone.Identifier ADS for HostUrl/ReferrerUrl indicators (e.g., HostUrl=about:internet). Optional: absence of a large HTTP download record for the same URL/client in proxy logs (suggests local assembly)
WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=1EDR:detectionApp reputation telemetryWinEventLog:SysmonEventCode=15Network TrafficNone
Linux Analytic 0873
Detection of browser-based downloads from HTML sources that trigger file creation in temp or user directories followed by execution of new files within short timeframes and suspicious parent-child lineage.
auditd:SYSCALLexecvelinux:osqueryfile_events
macOS Analytic 0874
Detection of HTML-based downloads via Safari/Chrome that create obfuscated files (e.g.,.zip,.app,.js) in user directories and are followed by suspicious executions from preview or launch services.
macos:unifiedlogFile Eventsmacos:osqueryprocess_eventsgatekeeper/quarantine databaseLaunchServices quarantine
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious HTML File Creation | Medium | Elastic TOML |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious File Delivery via HTML Smuggling | Undefined | Elastic TOML |