Phish - SVG Smuggling Payload Assembly (T1027)
Detects modern phishing tradecraft where malicious JavaScript is embedded inside SVG image files. The browser evaluates the SVG, decodes a Base64 payload, and drops a secondary archive or executable directly to disk via Blob/Data URIs. This rule specifically looks for file creation events in the Downloads folder for common executable or archive file types, correlated with browser processes (Chrome, Edge, Firefox) accessing local SVG files.
Microsoft Sentinel (KQL)
