How to mitigate HTML smuggling phishing attacks

[Translator]

Hello,Security

What are the solutions for mitigating HTML smuggling phishing attacks:

• https://attack.mitre.org/techniques/T1027/006/
• https://www.microsoft.com/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks/

Any built-in protection into ESA for example?

Thanks and Regards

[UdupiKrishna]

Such campaigns can be inspected/detected with a combination of different features that ESA supports.

E.g. antispam, AV, AMP can inspect the contents of the email/attachment to determine malicious patterns. URL filtering can run reputation and category checks of the URL(s), links within the email. Outbreak filters can determine if there's any ongoing malicious campaign matching similar patterns detected by Cisco/TALOS. 

In retrospect, all these features should be configured to work together to determine sophisticated attacks