Detect baseStriker on Cisco ESA

[beVa]

Hi all,

is Cisco ESA able to detect baseStriker emails? Our tests failed and we are not sure how we should detect emails like this.

Thank you for your help

[Dustin Anderson]

I would think you could make some custom filters based off what it looks like.

https://www.w3schools.com/tags/tag_base.asp 

Since it says it is usually href or target, you could look for these in the message body.

<base

For less false positives, you could use these.

<base href=
<base target=

Seems like any use of the base trick uses one of those 2 code.