HTML smuggling
HTML attachment assembles the payload locally with JavaScript, evading gateway inspection
categorySocial engineering and human-targeted attacksseverityVery Highdetectability (measured in our lab)Lowlabpartially detected
Example: NOBELIUM
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1027.006 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1027.006 -TestGuids 30cbeda4-08d9-42f1-8685-197fad677734 -GetPrereqs; Invoke-AtomicTest T1027.006 -TestGuids 30cbeda4-08d9-42f1-8685-197fad677734 -TimeoutSeconds 120'powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1027.006 -Tool atomic -RunId run-2026-11-02-009 -Command 'Invoke-AtomicTest T1027.006 -TestGuids 30cbeda4-08d9-42f1-8685-197fad677734 -GetPrereqs; Invoke-AtomicTest T1027.006 -TestGuids 30cbeda4-08d9-42f1-8685-197fad677734 -TimeoutSeconds 120'What our lab measured
partially detected windows · 2026-11-02 · detected in 44s
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 1 | Powershell process spawned powershell instance |
| Sysmon · EID 10 | Session-token scraping: non-browser process opened browser memory with read access |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| Sysmon · EID 11 | Scripting file created under Windows Temp or User folder |
| PowerShell · EID 4104 | Powershell script querying system environment variables |
| PowerShell · EID 4104 | Powershell script recursively collected files from a filesystem search |
| PowerShell · EID 4104 | Powershell script searching filesystem |
| PowerShell · EID 4104 | Powershell script used "Invoke-command" cmdlet to execute sub script |
| … and 6 more event type(s) | |
Detection that fired
- ✓ Wazuh
100202(level 11) lab rule — Session-token scraping: non-browser process opened browser memory with read access
Plus 13 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~11062 incidental alerts/hour — tune against this.
Classification
30 values: 9 reviewed, 2 lab-measured, 12 imported, 7 derived. What do these mean?
Exploitability
| Attack vector | |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Active |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | AvailabilityConfidentialityIntegrity |
| Platform | LinuxmacOSWindows |
| Environment | CloudOn-premises |
| Target asset class | Endpoint |
| Kill-chain phase (tactic) | Stealth |
Detection & telemetry
| Detectability (measured in our lab) | Low |
|---|---|
| Detectability (public detection content) | Low |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | File CreationNetwork Traffic ContentProcess Creation |
| Defense bypassed | Anti-virusStatic file analysisWeb proxy |
Detection & response
Mitigated by 1
- M1048 attack-mitigation
Detected by 1
- DET0313 attack-detection-strategy
Tested by 1
30cbeda4-08d9-42f1-8685-197fad677734atomic
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-11-02-009 | partially-detected | atomic | windows | 2026-11-02 |
run-2026-11-02-009— Backlog detectability-baseline probe (priority 7, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1027.006 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: bearing attack reads blind (detectability none/low); MITRE documents a detection strategy.; expected=0 incidental=295 max_level=15 dwell_s=90
Framework references
- Primary source: https://www.microsoft.com/en-us/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks/
- attack: T1027.006 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Social engineering and human-targeted attacks' table, line 50 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-009 (partially-detected) for T1027.006: no alert matched the expected technique