Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15 detections
Filters
Last updated
All Time
Detection languages
9
2
2
1
1
Contributors
3
3
2
1
1
Categories
6
5
5
5
3
Platforms
7
6
3
1
1
Products / Services
6
3
2
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects SVG image files that contain embedded HTML or script payloads, often used as an initial delivery vector to smuggle malicious code (such as downloaders or web redirects) into a target environment. This technique has been associated with the delivery of various remote access trojans (RATs).
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
Detects inbound emails containing attachments with file extensions commonly used for HTML/SVG smuggling (.html, .htm, .svg, .shtml, .xhtml). This technique is often used to bypass email security filters by assembling malicious payloads client-side after the email has been delivered. The rule specifically looks for inbound emails where the attachment has not been blocked or junked by the email gateway.
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
Detects the presence of SVG files containing obfuscated JavaScript and redirection logic. This technique is used by phishing campaigns, such as Tykit, to redirect victims to malicious sites.
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
This rule detects HTTP responses containing SVG (Scalable Vector Graphics) content that also embeds base64 encoded data starting with 'TVQAA'. This specific sequence ('TVQAA') is characteristic of a base64 encoded Windows executable (MZ header). The rule aims to identify a technique known as SVG smuggling, where malicious executables are hidden within SVG files and delivered to clients, often as a defense evasion tactic.
This rule detects the use of SVG files for HTML smuggling payloads. Specifically, it looks for HTTP responses containing an SVG file ('.svg' in the URI) that also contain '<script' and 'Blob(' within its data. This combination is indicative of an HTML smuggling technique where malicious content is hidden within a seemingly innocuous SVG file and then processed by JavaScript to construct a malicious payload, often a file download.
Detects SVG files embedding base64 executables for HTML smuggling
Detects a sequence of file creations (.svg, .zip, .bat) on a single host within a short time window, which is indicative of a malicious SVG-based download campaign delivering payloads like XWorm and Remcos.
This rule detects the creation of Scalable Vector Graphics (SVG) files on a system, particularly those initiated by common applications like Outlook, web browsers, or archive utilities. It then correlates this file creation with subsequent network activity from a browser process within a 5-minute window. The network activity is further scrutinized for suspicious URLs, specifically those using Cloudflare Workers domains with a specific pattern or URLs containing an '@' symbol, which can indicate obfuscation or malicious redirection attempts. This behavior is indicative of SVG smuggling techniques used to deliver malicious payloads or redirect users to phishing sites.
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
No description available.
This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox.
KQL Query from file: Email Campaign - Exploiting SVG Files and trycloudflare.com to Spread Malware