sublimehighRule

Attachment: SVG files with evasion elements

This rule identifies incoming SVG vector graphics files containing specific patterns: circle elements combined with either embedded images, hyperlinks, QR codes, or filenames that match recipient information. Limited to three attachments. SVG circle elements have been used to obfuscate QR codes and bypass automated QR code scanning methods.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1566 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and length(attachments) < 4
and any(attachments,
        (
          .file_extension == "svg"
          or .content_type in ("image/svg+xml")
          or .file_type == "svg"
        )
        and any(file.explode(.),
                any(.scan.xml.tags, . == "circle")
                and 1 of (
                  any(.scan.xml.tags, . in ("image", "a")),
                  .scan.qr.data is not null,
                  any(recipients.to,
                      strings.icontains(..file_name, .email.local_part)
                  ),
                  any(recipients.to,
                      strings.icontains(..file_name, .email.domain.sld)
                  )
                )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Attachment: SVG files with evasion elements"
description: "This rule identifies incoming SVG vector graphics files containing specific patterns: circle elements combined with either embedded images, hyperlinks, QR codes, or filenames that match recipient information. Limited to three attachments. SVG circle elements have been used to obfuscate QR codes and bypass automated QR code scanning methods."
type: "rule"
severity: "high"
source: |
  type.inbound
  and length(attachments) < 4
  and any(attachments,
          (
            .file_extension == "svg"
            or .content_type in ("image/svg+xml")
            or .file_type == "svg"
          )
          and any(file.explode(.),
                  any(.scan.xml.tags, . == "circle")
                  and 1 of (
                    any(.scan.xml.tags, . in ("image", "a")),
                    .scan.qr.data is not null,
                    any(recipients.to,
                        strings.icontains(..file_name, .email.local_part)
                    ),
                    any(recipients.to,
                        strings.icontains(..file_name, .email.domain.sld)
                    )
                  )
          )
  )
tags:
 - "Attack surface reduction"
attack_types:
  - "Malware/Ransomware"
  - "Credential Phishing"
tactics_and_techniques:
  - "QR code"
  - "Image as content"
  - "Evasion"
detection_methods:
  - "File analysis"
  - "XML analysis"
  - "QR code analysis"
  - "Sender analysis"
id: "5d2dbb60-d4bd-5231-bc3e-712e1cda865a"