tfMITRE ATT&CK sub-technique

HTML Smuggling T1027.006

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 20 May 2021
Last modified: 12 May 2026
Contributors: Jonathan Boucher, @crash_wave, Bank of Canada; Krishnan Subramanian, @krish203; Stan Hegt, Outflank; Vinay Pidathala

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

HTML Smuggling MITRE reference T1027.006

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT29G0016 ↗

Has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.1

created 2017-05-311 referenceaka IRON RITUAL

All 1 groups for this technique

Offense vs defense T1027.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

HTML Smuggling detection strategy DET0313

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for HTML Smuggling via JavaScript Blob + Dynamic File Drop

Enterprise

3 platforms

AN0872 · Windows

Detection of browser-based or email client-driven file creation (often from temp directories) following navigation to or execution of HTML files containing JavaScript Blob APIs or base64 Data URLs, with follow-on execution of the dropped payload. Leveraging Sysmon EventID 15 to inspect Zone.Identifier ADS for HostUrl/ReferrerUrl indicators (e.g., HostUrl=about:internet). Optional: absence of a large HTTP download record for the same URL/client in proxy logs (suggests local assembly)

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15
Network Traffic ContentDC0085	Network Traffic	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time range between HTML file open and file drop + execution (e.g., 1–10 minutes)
DroppedFileExtensionWatchlist	Tunable list of file extensions of interest (e.g., .js, .hta, .exe)
ParentProcessName	Expected processes that may drop files (e.g., browser, Outlook); tune for normal behavior

AN0873 · Linux

Detection of browser-based downloads from HTML sources that trigger file creation in temp or user directories followed by execution of new files within short timeframes and suspicious parent-child lineage.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File CreationDC0039	linux:osquery	file_events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DownloadPathRegex	Regular expressions for common download paths (e.g., /tmp/, ~/Downloads/)
ExecutableTriggerWindow	Tunable range for follow-up process execution from dropped file (e.g., 5–15 minutes)

AN0874 · macOS

Detection of HTML-based downloads via Safari/Chrome that create obfuscated files (e.g., .zip, .app, .js) in user directories and are followed by suspicious executions from preview or launch services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
File CreationDC0039	macos:unifiedlog	File Events
File MetadataDC0059	gatekeeper/quarantine database	LaunchServices quarantine

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
QuarantineFlagCheck	Whether downloaded file has a quarantine flag and is bypassed via Gatekeeper
BlobKeywordAlertList	JavaScript strings that may indicate smuggling: msSaveBlob, download.href, createObjectURL

Application Isolation and SandboxingM1048

Use Browser Extensions or Built-in Security Tools that: - Monitor JavaScript API calls such as Blob, URL.createObjectURL, and msSaveOrOpenBlob - Intercept and analyze HTML5 download attributes for suspicious payload generation - Alert or block behaviors that match known HTML smuggling patterns (e.g., blob-to-disk payload construction) Apply Content Security Policy (CSP) headers to: - Restrict inline JavaScript and dynamic script generation - Disallow downloads from unauthorized sources or blob URIs - Prevent cross-origin resource sharing (CORS) abuse commonly used in smuggling chains Enable or enforce enterprise browser security controls, such as: - Endpoint's Network Protection and Attack Surface Reduction (ASR) rules, which can block Office and browser processes from creating child processes or writing to disk in suspicious ways - Google Chrome Enterprise Policies, which can control file download behavior, restrict extensions, and isolate risky browsing environments Deploy browser sandboxing solutions that can isolate JavaScript execution environments and enforce behavioral policy restrictions

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	HTML Smuggling Remote Payload	windows	PowerShell	—	1	Yes
The HTML file will download an ISO file from T1553.005 without user interaction. The HTML file is based off of the work from Stan Hegt Attack command & "PathToAtomicsFolder\T1027.006\bin\T1027_006_remote.html" Cleanup command $user = [System.Environment]::UserName; Remove-Item -Path C:\Users\$user\Downloads\FeelTheBurn.iso -ErrorAction Ignore Prerequisite T1027_006_remote.html must exist on disk at specified at PathToAtomicsFolder\T1027.006\bin\T1027_006_Remote.html Check if (Test-Path "PathToAtomicsFolder\T1027.006\bin\T1027_006_Remote.html") { exit 0} else { exit 1} Satisfy New-Item -Type Directory "PathToAtomicsFolder\T1027.006\bin\" -ErrorAction ignore \| Out-Null Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.006/bin/T1027_006_Remote.html" -OutFile "PathToAtomicsFolder\T1027.006\bin\T1027_006_Remote.html" GUID32fd8341-a943-4dad-8f1a-fb65e6d9c875

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

HTML Smuggling Remote Payload

windows

PowerShell

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

HTML Smuggling detections T1027.006

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs