Detect SVG Smuggling in IBM QRadar
Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files. SVGs are vector-based image files constructed using XML and can legitimately include <script> tags, enabling adversaries to embed malicious JavaScript payloads. SVGs may appear less suspicious to users than other executable file types since they are often treated as image files. SVG smuggling can assemble or download malicious payloads, redirect users to malicious websites, or display interactive content such as fake login forms. SVG Smuggling may be used in conjunction with HTML Smuggling where an SVG with a malicious payload is included inside an HTML file.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.017 SVG Smuggling
- Canonical reference
- https://attack.mitre.org/techniques/T1027/017/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
username AS UserName,
"Computer" AS Hostname,
"EventID" AS EventID,
"Image" AS ProcessImage,
"CommandLine" AS CommandLine,
"ParentImage" AS ParentProcessImage,
"ParentCommandLine" AS ParentCommandLine,
"TargetFilename" AS TargetFile,
CASE
WHEN "EventID" = '11' AND REGEXP_MATCH("TargetFilename", '(?i)\.svg$')
THEN 'SVG_File_Written_By_Browser_Or_Mail'
WHEN "EventID" = '1'
AND (REGEXP_MATCH("CommandLine", '(?i)\.svg')
OR REGEXP_MATCH("ParentCommandLine", '(?i)\.svg'))
THEN 'SVG_Context_Suspicious_Process_Spawn'
ELSE 'Browser_Mail_Client_Spawned_Suspicious_Process'
END AS DetectionType,
(CASE WHEN "EventID" = '11' THEN 1 ELSE 0 END
+ CASE WHEN REGEXP_MATCH("CommandLine", '(?i)\.svg')
OR REGEXP_MATCH("ParentCommandLine", '(?i)\.svg') THEN 1 ELSE 0 END
+ CASE WHEN REGEXP_MATCH("Image", '(?i)(cmd\.exe|powershell\.exe|wscript\.exe|mshta\.exe)') THEN 1 ELSE 0 END) AS RiskScore
FROM events
WHERE
"EventID" IN ('1', '11')
AND REGEXP_MATCH("ParentImage", '(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|opera\.exe|brave\.exe|outlook\.exe|thunderbird\.exe|winmail\.exe)')
AND (
(
"EventID" = '1'
AND REGEXP_MATCH("Image", '(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|msiexec\.exe|bitsadmin\.exe|curl\.exe|wget\.exe)')
)
OR (
"EventID" = '11'
AND REGEXP_MATCH("TargetFilename", '(?i)\.svg$')
)
)
LAST 24 HOURS
ORDER BY starttime DESCDetects SVG Smuggling (T1027.017) in IBM QRadar SIEM by querying Sysmon event fields ingested via the Sysmon Universal DSM or WinCollect agent. Targets EventID 1 (Process Create) and EventID 11 (File Create) events where a browser or mail client (ParentImage) is the initiating process. Regex matching via REGEXP_MATCH() identifies suspicious child processes and SVG file writes. A CASE statement classifies each alert into one of three sub-types, and a composite RiskScore column enables triage prioritisation. Custom event properties (Image, ParentImage, CommandLine, TargetFilename) must be extracted via the Sysmon DSM field mapping in QRadar.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise browser management or endpoint security agents (e.g., Cisco Umbrella roaming client, Zscaler Client Connector) that hook browser processes and legitimately invoke cmd.exe or powershell.exe for network policy enforcement — these will match the ParentImage filter.
- Corporate Outlook deployments integrated with DLP or email gateway tools that spawn script-based utilities (certutil.exe, msiexec.exe) as part of attachment scanning or S/MIME certificate validation workflows.
- Developer workstations where web-based IDEs (JupyterLab, Eclipse Theia in browser) invoke shell processes for code execution or build triggers — browser parent + cmd/powershell child is a legitimate pattern in these environments.
Other platforms for T1027.017
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create and Open Malicious SVG with Embedded JavaScript
Expected signal: Sysmon Event ID 11: File Create — TargetFilename ending in Invoice-2024.svg written to Downloads directory by powershell.exe. Sysmon Event ID 1: Process Create — browser process (e.g., msedge.exe or chrome.exe) launched with the SVG file path as argument. Sysmon Event ID 3: Network Connection — may be generated if browser makes requests after opening file.
- Test 2SVG Smuggling with Blob URL Payload Download Simulation
Expected signal: Sysmon Event ID 11: File Create — document-viewer.svg written to Downloads by powershell.exe. If opened in browser: Sysmon Event ID 11 — browser may write document.exe to Downloads directory. Sysmon Event ID 1 — browser process launch with SVG path. Network telemetry: Blob URL creation stays local (no external network), but browser history records the file:// URI.
- Test 3SVG File Delivered via Email Simulation with Zone Identifier Check
Expected signal: Sysmon Event ID 11: File Create — Invoice_March2024.svg created in Outlook INetCache directory by powershell.exe. Sysmon Event ID 15 (FileCreateStreamHash): ADS Zone.Identifier written to the SVG file, indicating internet-sourced content (Zone=3). This ADS event is a strong indicator of an externally-sourced file.
- Test 4SVG Embedded in HTML File (HTML Smuggling Combination)
Expected signal: Sysmon Event ID 11: File Create — invoice-document.html written to Downloads by powershell.exe. Select-String output confirms presence of <svg>, <script>, atob, and blob indicators in the file. If opened in browser: potential Sysmon Event ID 11 for invoice.exe creation in Downloads.
References (10)
- https://attack.mitre.org/techniques/T1027/017/
- https://blog.talosintelligence.com/html-smugglers-turn-to-svg-images/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pixel-perfect-trap-the-surge-of-svg-borne-phishing-attacks/
- https://www.bleepingcomputer.com/news/security/phishing-emails-increasingly-use-svg-attachments-to-evade-detection/
- https://cofense.com/blog/svg-files-abused-in-emerging-campaigns/
- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.006/T1027.006.md
- https://www.w3.org/TR/SVG2/interact.html#EventAttributes
- https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CommonStatsFunctions
Unlock Pro Content
Get the full detection package for T1027.017 including response playbook, investigation guide, and atomic red team tests.