Description

This rule identifies incoming SVG vector graphics files containing specific patterns: circle elements combined with either embedded images, hyperlinks, QR codes, or filenames that match recipient information. Limited to three attachments. SVG circle elements have been used to obfuscate QR codes and bypass automated QR code scanning methods.

References

No references.

Sublime Security
Created Feb 21st, 2025 • Last updated May 8th, 2026
Source
type.inbound
and length(attachments) < 4
and any(attachments,
        (
          .file_extension == "svg"
          or .content_type in ("image/svg+xml")
          or .file_type == "svg"
        )
        and any(file.explode(.),
                any(.scan.xml.tags, . == "circle")
                and 1 of (
                  any(.scan.xml.tags, . in ("image", "a")),
                  .scan.qr.data is not null,
                  any(recipients.to,
                      strings.icontains(..file_name, .email.local_part)
                  ),
                  any(recipients.to,
                      strings.icontains(..file_name, .email.domain.sld)
                  )
                )
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started