Detecting HTML Smuggling: Blob Payloads Built in the Browser

HTML smuggling hides a payload inside JavaScript that decodes it and saves it locally using browser APIs, so network controls see only an HTML file or page. The payload (an ISO, ZIP, script or executable) is created on the endpoint. That makes the artefacts worth hunting the HTML itself, the blob-origin download and what runs next.

Signals at a Glance

Catching the HTML

Legitimate pages use Blob and base64 too, but an attachment that builds a Blob from an embedded string and clicks a download link is unusual. Score the combination, not a single keyword:

rule hunt_html_smuggling_blob_download
{
  meta:
    description = "HTML with embedded base64 blob assembly and forced download"
    note = "hunting rule - tune/validate on your own mail corpus before blocking"
  strings:
    $blob1 = "new Blob" nocase
    $blob2 = "createObjectURL" nocase
    $legacy = "msSaveOrOpenBlob" nocase
    $dec = "atob(" nocase
    $dl1 = ".download =" nocase
    $dl2 = "download=" nocase
    $click = ".click()" nocase
  condition:
    filesize < 5MB and
    (1 of ($blob*)) and ($dec or $legacy) and (1 of ($dl*)) and $click
}

Blob Origin and What Runs Next

Microsoft Defender records the download origin for files a browser writes. A blob: or empty origin on a risky file type, followed by execution, is the endpoint view of the same technique:

// Defender XDR (KQL) - risky file written by a browser from a blob origin, then executed
let drops = DeviceFileEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe")
| where FileName matches regex @"(?i)\.(iso|img|zip|rar|7z|lnk|js|jse|vbs|hta|exe|dll|msi)$"
| where FileOriginUrl startswith "blob:" or isempty(FileOriginUrl)
| project DropTime=Timestamp, DeviceId, DeviceName, FileName, FolderPath, SHA256;
drops
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | project ExecTime=Timestamp, DeviceId, ProcessCommandLine, InitiatingProcessFileName, ExecFolder=FolderPath
) on DeviceId
| where ExecTime between (DropTime .. DropTime + 30m)
| where ProcessCommandLine has FileName or ExecFolder has FileName
// tune/validate: empty origin also covers some legitimate in-browser exports

• Have the gateway detonate or strip HTML attachments for users who have no business reason to receive them, and rewrite the rest to open in a protected viewer.
• Hunt for HTML attachments with very long single-line strings; payloads are usually one large base64 literal.
• Review browser download policy: block risky file types downloaded from email-originated pages, and require the mark of the web to be preserved on saved files.