Detection Method: XML analysis

XML analysis inspects XML files, which are often used for data exchange and configuration, to identify embedded malicious elements that could pose security risks. This method looks at the structure, content, and relationships within XML documents to spot potentially dangerous components.
XML analysis can detect:
  • Malicious scripts hidden inside XML structures
  • Suspicious URLs or external references embedded in XML attributes or elements
  • XML external entity (XXE) injection attempts
  • Data exfiltration methods disguised as legitimate XML
  • Obfuscated commands or code snippets hidden in XML fields
For example, attackers might use XML files, such as Microsoft Office's Open XML formats (.docx, .xlsx), to hide malicious macros or scripts. But with XML analysis, you can parse these structures and uncover the threats within.
Blog Post
Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics · Blog · Sublime Security
Scripting Vector Grifts: SVG phishing with smuggled JS and adversary in the middle tactics · Blog · Sublime Security
Embedding malicious JS code within SVGs to deliver adversary in the middle credential phishing attacks.
Attack Types (3):
BEC/Fraud
Credential Phishing
Malware/Ransomware
Tactics & Techniques (9):
Spoofing
Evasion
Impersonation: Employee
Social engineering
Scripting
Impersonation: Brand
Free email provider
Image as content
QR code
Rule Name & Severity
Last Updated
Author
Types, Tactics & Capabilities
Spoofing: Hidden Outlook headers in self-addressed forwards
4h ago
Oct 6th, 2026
Sublime Security
BEC/Fraud
Credential Phishing
Spoofing
Evasion
Impersonation: Employee
Social engineering
Header analysis
HTML analysis
XML analysis
Sender analysis
Natural Language Understanding
Attachment: Malformed mobileconfig file
7d ago
Sep 29th, 2026
Sublime Security
Credential Phishing
Evasion
File analysis
XML analysis
Attachment: Embedded Javascript in SVG file
8d ago
Sep 28th, 2026
Sublime Security
Malware/Ransomware
Scripting
Archive analysis
File analysis
Sender analysis
XML analysis
Attachment: Fake mobileconfig security update profile
11d ago
Sep 25th, 2026
Sublime Security
Credential Phishing
Impersonation: Brand
Social engineering
Evasion
File analysis
Content analysis
XML analysis
Attachment: Word document with hyperlink and fraud language
1mo ago
Sep 4th, 2026
Sublime Security
Credential Phishing
BEC/Fraud
Free email provider
Social engineering
Evasion
File analysis
XML analysis
HTML analysis
URL analysis
Natural Language Understanding
Sender analysis
Attachment: Targeted DOCX with personalized recipient acknowledgement lure
2mo ago
Aug 4th, 2026
Sublime Security
Credential Phishing
Social engineering
Archive analysis
Content analysis
File analysis
XML analysis
Attachment: SVG file with hyperlinks and cursor styling
4mo ago
May 20th, 2026
Sublime Security
Credential Phishing
Evasion
Image as content
File analysis
XML analysis
Content analysis
Attachment: SVG files with evasion elements
5mo ago
May 8th, 2026
Sublime Security
Malware/Ransomware
Credential Phishing
QR code
Image as content
Evasion
File analysis
XML analysis
QR code analysis
Sender analysis
Attachment: DOCX with hyperlink targeting recipient address
9mo ago
Dec 17th, 2025
Sublime Security
Credential Phishing
Malware/Ransomware
Evasion
Social engineering
File analysis
Archive analysis
XML analysis