SVG Phishing Campaign
This detection identifies potential phishing or staging activity where Microsoft Outlook creates an SVG file, followed shortly by a web browser downloading a ZIP archive. The correlation between Outlook-based SVG creation and a browser-initiated ZIP download within one minute may indicate an attacker-controlled workflow for delivering additional payloads.
Microsoft Sentinel (KQL)
