From ee59cd6042bc778f976d07e713cd949136e3485c Mon Sep 17 00:00:00 2001
From: Cameron Dunn <cameron@sublimesecurity.com>
Date: Tue, 24 Oct 2023 21:42:57 -0700
Subject: [PATCH] and delete

---
 .../attachment_html_all_script.yml            | 30 -------------------
 1 file changed, 30 deletions(-)
 delete mode 100644 detection-rules/attachment_html_all_script.yml

diff --git a/detection-rules/attachment_html_all_script.yml b/detection-rules/attachment_html_all_script.yml
deleted file mode 100644
index ac5b9b86b91..00000000000
--- a/detection-rules/attachment_html_all_script.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: "Attachment: HTML file contains exclusively Javascript"
-description: |
-  Attached HTML file does not contain any HTML other than a <script> block.
-type: "rule"
-severity: "medium"
-source: |
-  type.inbound
-  and any(attachments,
-          (
-            .file_extension in~ ("html", "htm", "shtml", "dhtml")
-            or .file_extension in~ $file_extensions_common_archives
-            or .file_type == "html"
-          )
-          and any(file.explode(.),
-                  length(.scan.strings.strings) == 1
-                  and any(.scan.strings.strings, strings.starts_with(., "<script>"))
-                  and any(.scan.strings.strings, strings.ends_with(., "</script>"))
-          )
-  )
-attack_types:
-  - "Credential Phishing"
-  - "Malware/Ransomware"
-tactics_and_techniques:
-  - "Evasion"
-  - "HTML smuggling"
-  - "Scripting"
-detection_methods:
-  - "Archive analysis"
-  - "File analysis"
-id: "b6d38168-20bb-5550-8843-6af9426af8b1"