HTML Smuggling Blob to Disk Execution

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

This rule detects a potential HTML smuggling attack where a browser (Chrome or Edge) saves a file (specifically ISO, IMG, VHD, ZIP, or RAR extensions) via a JavaScript Blob, and that same file is executed by the user via Windows Explorer within a 10-minute window. This chain of events is indicative of a phishing technique used to bypass traditional security controls.