Detection rules › Sublime MQL
Attachment: SVG files with evasion elements
This rule identifies incoming SVG vector graphics files containing specific patterns: circle elements combined with either embedded images, hyperlinks, QR codes, or filenames that match recipient information. Limited to three attachments. SVG circle elements have been used to obfuscate QR codes and bypass automated QR code scanning methods.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware, Credential Phishing |
| Tactics and techniques | QR code, Image as content, Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and length(attachments) < 4
and any(attachments,
(
.file_extension == "svg"
or .content_type in ("image/svg+xml")
or .file_type == "svg"
)
and any(file.explode(.),
any(.scan.xml.tags, . == "circle")
and 1 of (
any(.scan.xml.tags, . in ("image", "a")),
.scan.qr.data is not null,
any(recipients.to,
strings.icontains(..file_name, .email.local_part)
),
any(recipients.to,
strings.icontains(..file_name, .email.domain.sld)
)
)
)
)
Detection logic
Scope: inbound message.
This rule identifies incoming SVG vector graphics files containing specific patterns: circle elements combined with either embedded images, hyperlinks, QR codes, or filenames that match recipient information. Limited to three attachments. SVG circle elements have been used to obfuscate QR codes and bypass automated QR code scanning methods.
- inbound message
- length(attachments) < 4
any of
attachmentswhere all hold:any of:
- .file_extension is 'svg'
- .content_type in ('image/svg+xml')
- .file_type is 'svg'
any of
file.explode(.)where all hold:any of
.scan.xml.tagswhere:- . is 'circle'
at least 1 of:
any of
.scan.xml.tagswhere:- . in ('image', 'a')
- .scan.qr.data is set
any of
recipients.towhere:- strings.icontains(.file_name)
any of
recipients.towhere:- strings.icontains(.file_name)
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, recipients.to, recipients.to[].email.domain.sld, recipients.to[].email.local_part, type.inbound. Sensors: file.explode, strings.icontains.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | svg |
attachments[].content_type | member | image/svg+xml |
attachments[].file_type | equals | svg |
file.explode(attachments[])[].scan.xml.tags[] | equals | circle |
file.explode(attachments[])[].scan.xml.tags[] | member | image |
file.explode(attachments[])[].scan.xml.tags[] | member | a |