T1027.006 — HTML Smuggling

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects.…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.006 Obfuscated Files or Information: HTML Smuggling

title: "T1027.006 Obfuscated Files or Information: HTML Smuggling"
id: b198c99e-e117-4667-af13-dbe404daa728
description: 'Detection Strategy for HTML Smuggling via JavaScript Blob + Dynamic File Drop. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, DroppedFileExtensionWatchlist, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1027/006
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.stealth
  - attack.t1027.006

logsource:
  product: windows
  service: sysmon

detection:
  selection_base:
    EventID: '11'
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
  selection_download_path:
    TargetFilename|contains: '\Downloads\'
  selection_suspicious_ext:
    TargetFilename|endswith:
      - '.iso'
      - '.img'
      - '.js'
      - '.jse'
      - '.hta'
      - '.vbs'
      - '.wsf'
      - '.chm'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_base and selection_browser and selection_download_path and selection_suspicious_ext and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.
  - Legitimate ISO/IMG software distribution downloads (e.g. OS images, dev tools) landing in the Downloads folder via a browser.

level: medium

T1027.006 Obfuscated Files or Information: HTML Smuggling

title: "T1027.006 Obfuscated Files or Information: HTML Smuggling"
id: af618bb1-0aa1-4ec0-a34f-fc6dceda651c
description: 'Detection Strategy for HTML Smuggling via JavaScript Blob + Dynamic File Drop. HTML Smuggling happens entirely inside the browser''s JavaScript engine (Blob/Data-URL construction and the HTML5 download attribute) and leaves no distinguishing auditd process signature -- it is NOT observable via Linux process-creation telemetry, and the previous version''s check for a browser EXECVE record whose argv contains "Downloads" is not how browsers are invoked (browsers do not receive the download target directory as a CLI argument) and was confirmed unreachable by its own falsepositives note. Genuinely detecting this requires cross-event correlation (browser download-artifact/history plus subsequent execution) that a single auditd process_creation rule cannot perform. The closest defensible Linux-observable proxy implemented here is direct execution of a file located inside a user Downloads directory or browser cache path, consistent with running a payload shortly after the browser silently drops it there -- this cannot confirm HTML smuggling was the delivery mechanism versus any other download method. Tune using: DownloadPathRegex, ExecutableTriggerWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/006
author: Shahrukh Khan
date: 2026-02-15
license: MIT
tags:
  - attack.stealth
  - attack.t1027.006

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_exec_from_download_path:
    type: EXECVE
    a0|contains:
      - '/Downloads/'
      - '/.cache/mozilla/firefox/'
      - '/.cache/google-chrome/'
      - '/.cache/chromium/'

  condition: selection_exec_from_download_path

falsepositives:
  - Users routinely execute legitimately downloaded installers, scripts, or AppImages directly from ~/Downloads or a browser cache path; this signal alone cannot confirm the file arrived via HTML smuggling versus any other delivery mechanism and should be paired with browser download-history/network proxy logs for confirmation.

level: low

T1027.006 Obfuscated Files or Information: HTML Smuggling

title: "T1027.006 Obfuscated Files or Information: HTML Smuggling"
id: f7e54c37-6f01-4f62-be7c-cdf19798913a
description: 'Detection Strategy for HTML Smuggling via JavaScript Blob + Dynamic File Drop. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: QuarantineFlagCheck, BlobKeywordAlertList.'
references:
  - https://attack.mitre.org/techniques/T1027/006
author: Shahrukh Khan
date: 2026-06-14
license: MIT
tags:
  - attack.stealth
  - attack.t1027.006

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|endswith: '.html'
  selection_process:
    Image|endswith:
      - '/Safari'
      - '/Google Chrome'
      - '/curl'
  condition: selection and selection_process

falsepositives:
  - Normal browsing activity that saves HTML pages locally, since the quarantine attribute state of the file is not always captured by the file_event category itself.

level: medium

Related sub-techniques

Explore