detection.wiki

Detection rules › Sublime MQL

Attachment: SVG file with HTML entity encoded href attributes

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects SVG file attachments containing href attributes with three or more consecutive HTML numeric entity references, a technique used to obfuscate malicious URLs and evade security scanning.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware, Credential Phishing
Tactics and techniquesEvasion, HTML smuggling

Event coverage

Message attribute
attachments (collection)
type

Rule body MQL

type.inbound
and any(attachments,
        (
          .file_extension == "svg"
          or .content_type in ("image/svg+xml")
          or .file_type == "svg"
        )
        // href value starting with 3+ HTML numeric entity references
        and regex.icontains(file.parse_text(.,
                                            encodings=[
                                              "ascii",
                                              "utf8",
                                              "utf16-le"
                                            ]
                            ).text,
                            'href\s*=\s*["\x27]\s*(?:&#x?[0-9a-f]+;\s*){3,}'
        )
)

Detection logic

Scope: inbound message.

Detects SVG file attachments containing href attributes with three or more consecutive HTML numeric entity references, a technique used to obfuscate malicious URLs and evade security scanning.

  1. inbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension is 'svg'
      • .content_type in ('image/svg+xml')
      • .file_type is 'svg'
    • file.parse_text(., encodings=['ascii', 'utf8', 'utf16-le']).text matches 'href\\s*=\\s*["\\x27]\\s*(?:&#x?[0-9a-f]+;\\s*){3,}'

Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.parse_text, regex.icontains.

Indicators matched (4)

FieldMatchValue
attachments[].file_extensionequalssvg
attachments[].content_typememberimage/svg+xml
attachments[].file_typeequalssvg
regex.icontainsregexhref\s*=\s*["\x27]\s*(?:&#x?[0-9a-f]+;\s*){3,}