<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-email-based-malware
description: >-
  Detect malware delivered via email attachments and embedded content including
  macro-enabled documents, archive-based payloads, HTML smuggling, QR code
  phishing, and link-based malware delivery.
domain: cybersecurity
subdomain: email-security
tags:
  - malware
  - attachments
  - macros
  - html-smuggling
  - sandbox
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.001", "T1204.002", "T1059.005"]
  tools: [yara, olevba, file, strings, clamav]
---

# Detecting Email-Based Malware

## Overview

Email remains the primary malware delivery vector. Detection requires analyzing
attachments for malicious macros, identifying archive-based evasion, detecting
HTML smuggling payloads, scanning embedded URLs, and leveraging sandbox
detonation for zero-day payloads.

## Prerequisites

- Tools: yara, olevba (oletools), file, strings, clamav
- Isolated analysis environment (sandbox/VM)
- Threat intelligence feeds for hash lookups

## Key Concepts

- **VBA macros**: Auto-executing code in Office documents (AutoOpen, Auto_Open)
- **HTML smuggling**: JavaScript-assembled payloads bypassing gateway scanning
- **Archive evasion**: Password-protected ZIPs hiding malicious executables
- **Double extensions**: Files like invoice.pdf.exe deceiving users

## Workflow

### Step 1: Attachment Triage

```bash
# Extract attachments from EML
munpack message.eml -C /tmp/attachments/

# Identify file types by magic bytes
file /tmp/attachments/*

# Calculate hashes for threat intel
sha256sum /tmp/attachments/*

# Strings analysis for suspicious content
strings -n 8 /tmp/attachments/* | grep -iE 'http|powershell|cmd|wscript|shell'
```

### Step 2: Office Document Analysis

```bash
# Check for VBA macros
olevba document.docx

# Check for DDE
python3 -c "
import zipfile
with zipfile.ZipFile('document.docx') as z:
    for name in z.namelist():
        content = z.read(name).decode('utf-8', errors='ignore')
        if 'DDE' in content or 'DDEAUTO' in content:
            print(f'DDE found in {name}')
"

# YARA rule scan
yara -r office_malware.yar /tmp/attachments/
```

### Step 3: HTML Smuggling Detection

```bash
# Look for base64 payloads in HTML
grep -oE 'atob\([^)]+\)' email_body.html
grep -oE 'Blob\(' email_body.html
grep -E 'createElement.*\.click\(\)' email_body.html
grep -E 'window\.URL\.createObjectURL' email_body.html
```

### Step 4: Archive and Nested Payload Analysis

```bash
# Check password-protected archives
7z l suspicious.zip

# Extract with common malware passwords
7z x -p"infected" suspicious.zip -o/tmp/extracted/
file /tmp/extracted/*

# Check for double extensions
ls /tmp/extracted/ | grep -E '\.[a-z]+\.[a-z]+$'

# ClamAV scan
clamscan -r /tmp/extracted/
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Macro execution | EDR/Sysmon | Office spawning cmd.exe or powershell.exe |
| HTML smuggling | Gateway | HTML with base64 blobs > 50KB |
| Password archive | Gateway | Encrypted archives with short passwords |

```yaml
title: Office Application Spawning Suspicious Process
id: f6a7b8c9-d0e1-2345-f012-678901234567
status: experimental
description: Detects Office apps spawning command interpreters from macros
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - "\\WINWORD.EXE"
      - "\\EXCEL.EXE"
    Image|endswith:
      - "\\cmd.exe"
      - "\\powershell.exe"
      - "\\wscript.exe"
  condition: selection
falsepositives:
  - Legitimate Office add-ins executing system commands
level: high
tags:
  - attack.t1204.002
  - attack.execution
```

## Verification

- [ ] Attachment file types identified and hashes computed
- [ ] Office macros analyzed for malicious content
- [ ] HTML smuggling patterns detected
- [ ] Archive contents extracted and scanned
- [ ] Sandbox detonation completed for suspicious samples

## References

- [MITRE T1566.001 — Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
- [oletools](https://github.com/decalage2/oletools)
- [HTML Smuggling Analysis](https://www.microsoft.com/en-us/security/blog/2021/11/11/html-smuggling-surges/)
