Malicious SVG Download Chain

Tim Peck@timpeck

•updated Sep 11, 2025•4•2•85

Detects a sequence of file creations (.svg, .zip, .bat) on a single host within a short time window, which is indicative of a malicious SVG-based download campaign delivering payloads like XWorm and Remcos.