High Severity
Attachment: SVG Files With Evasion Elements
Description
This rule identifies incoming SVG vector graphics files containing specific patterns: circle elements combined with either embedded images, QR codes, or filenames that match recipient information. Limited to three attachments and validates sender authenticity. SVG circle elements have been used to obfuscate QR codes and bypass automated QR code scanning methods.
References
No references.
Sublime Security
Created Feb 21st, 2025 • Last updated Jul 16th, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and length(attachments) < 4
and any(attachments,
(.file_extension == "svg" or .content_type in ("image/svg+xml"))
and any(file.explode(.),
any(.scan.xml.tags, . == "circle")
and 1 of (
any(.scan.xml.tags, . == "image"),
.scan.qr.data is not null,
any(recipients.to,
strings.icontains(..file_name, .email.local_part)
),
any(recipients.to,
strings.icontains(..file_name, .email.domain.sld)
)
)
)
)
and not profile.by_sender_email().any_messages_benign
and not profile.by_sender_email().solicited
Playground
Test against your own EMLs or sample data.