MITRE ATT&CK technique · stealth

`T1027.006` HTML Smuggling

Sub-technique of T1027 Obfuscated Files or Information

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

APT29

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.