HTML detection heuristics

HTA/VBScript DOM-text execution critical HTML_HTA_VBSCRIPT_DOM_EXECUTE

HTA/VBScript document executes code assembled from DOM text.

Third-party credential-harvest form critical HTML_THIRD_PARTY_CREDENTIAL_HARVEST

A branded page submits email credentials to a generic form collector and redirects to a trusted decoy.

HTML ActiveX/COM object high HTML_ACTIVEX_OBJECT

HTML script instantiates ActiveX or COM objects.

HTML Windows scripting object high HTML_WINDOWS_SCRIPTING_OBJECT

HTML references COM objects commonly used for execution or payload download.

HTML contains VBScript high HTML_VBSCRIPT

Standalone HTML contains a VBScript script block.

HTML credential form on dynamic-DNS host high HTML_CREDENTIAL_PHISH_DYNDNS

HTML sign-in form loads assets from or posts to a free dynamic-DNS/tunnel host.

HTML scripted COM execution high HTML_SCRIPTED_COM_EXECUTION

HTML script dynamically creates objects and invokes execution/open methods.

HTML smuggling: embedded file in script high HTML_SMUGGLED_PAYLOAD

A contiguous or constant-concatenated base64 value inside an inline script decodes to a complete archive, executable, document or HTA.

Script XOR-decodes base64 into eval high HTML_XOR_BASE64_EVAL_INJECTION

Inline script base64-decodes a blob, XORs it byte-by-byte, and evals the result.

HTML base64 payload medium HTML_LONG_BASE64_SCRIPT_PAYLOAD

HTML script contains a long or constant-concatenated base64-like blob.

HTML obfuscated string builder medium HTML_OBFUSCATED_STRING_BUILDER

HTML script repeatedly builds strings from small fragments.

Ad-fraud / traffic-cloaking doorway low HTML_AD_FRAUD_CLOAKING

Page pairs a CHEQ cloaking handler with an ad-network channel tracking iframe.

URL recovered from base64 script payload info HTML_BASE64_PAYLOAD_URL

A URL was recovered by decoding a long base64 blob inside an inline script.