Messages using Content-Transfer-Encoding: base64

Charles Profitt

13 de agosto de 2021 17:07

I have started to notice phishing messages that are using Content-Transfer-Encoding: base64 to obfuscate the text in the message. This then makes rules not function unless you translater the words into base64.

Is it possible for PhishER to decode Base64 and check the resultant text and apply rules?

0

• 

  Walter Nelson 16 de agosto de 2021 16:19

  Hi Charles,

  Thanks for posting. I've gone ahead and created a support ticket for you so that a support technician can help answer your question.

   

  0

  Ações de comentário Permalink
• 

  Scot Perkins 19 de outubro de 2021 23:57 (Editado 19 de outubro de 2021 23:57)

  Hi Charles, I submitted a feature request for this exact issue but my request was a little bit different.   Yara provides a modifier for base64 support (https://yara.readthedocs.io/en/stable/writingrules.html#base64-strings  As of the most recent update to PhishER, they (finally) support a version of Yara that allows you to make use of this modifier.

  0

  Ações de comentário Permalink

Por favor, entrar para comentar.