Sublime Security high experimental mql

Attachment: ICS with embedded Javascript in SVG file

Detects incoming messages containing ICS attachments with embedded SVG files that contain malicious JavaScript code, including base64-encoded content and potentially harmful event handlers. The rule specifically watches for onload events, location redirects, error handlers, and iframe elements with base64 data URIs.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_extension in~ ('ics')
          or .content_type in ("application/ics", "text/calendar")
        )
        and any(file.explode(.),
                (
                  .file_extension in~ ("svg", "svgz")
                  or .flavors.mime == "image/svg+xml"
                )
                and any(.scan.strings.strings,
                        strings.ilike(.,
                                      "*onload*",
                                      "*window.location.href*",
                                      "*onerror*",
                                      "*CDATA*",
                                      "*<script*",
                                      "*</script*",
                                      "*atob*",
                                      "*location.assign*",
                                      "*decodeURIComponent*"
                        )
                )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...