Inbound Email with Malicious SVG Attachment Disguised as HTML
This rule detects inbound emails with an SVG attachment that is disguised as an HTML file and contains a long, base64-like string in its filename. This pattern is often used in phishing campaigns to bypass traditional email filters and deliver malicious content, potentially leading to credential harvesting or malware delivery. The rule specifically looks for files with a '.svg' extension but a 'html' file type, combined with a filename containing a string of at least 20 alphanumeric characters, plus or minus, equal signs, which is characteristic of base64 encoding.
Microsoft Sentinel (KQL)
