Detection rules › Sublime MQL
Attachment: SVG file with hyperlinks and cursor styling
Detects inbound messages containing SVG attachments that include clickable hyperlink elements and CSS pointer cursor styling, which may be used to deceive recipients into clicking malicious links disguised as legitimate images.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Image as content |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension == "svg"
or .content_type in ("image/svg+xml")
or .file_type == "svg"
)
and any(file.explode(.), any(.scan.xml.tags, . == "a"))
and regex.icontains(file.parse_text(., encodings=["ascii", "utf8"]).text,
'cursor\s*=\s*["\x27]pointer'
)
)
Detection logic
Scope: inbound message.
Detects inbound messages containing SVG attachments that include clickable hyperlink elements and CSS pointer cursor styling, which may be used to deceive recipients into clicking malicious links disguised as legitimate images.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension is 'svg'
- .content_type in ('image/svg+xml')
- .file_type is 'svg'
any of
file.explode(.)where:any of
.scan.xml.tagswhere:- . is 'a'
- file.parse_text(., encodings=['ascii', 'utf8']).text matches 'cursor\\s*=\\s*["\\x27]pointer'
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, file.parse_text, regex.icontains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | svg |
attachments[].content_type | member | image/svg+xml |
attachments[].file_type | equals | svg |
file.explode(attachments[])[].scan.xml.tags[] | equals | a |
regex.icontains | regex | cursor\s*=\s*["\x27]pointer |