Sublime Security medium experimental mql

Attachment: SVG file with hyperlinks and cursor styling

Detects inbound messages containing SVG attachments that include clickable hyperlink elements and CSS pointer cursor styling, which may be used to deceive recipients into clicking malicious links disguised as legitimate images.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_extension == "svg"
          or .content_type in ("image/svg+xml")
          or .file_type == "svg"
        )
        and any(file.explode(.), any(.scan.xml.tags, . == "a"))
        and regex.icontains(file.parse_text(., encodings=["ascii", "utf8"]).text,
                            'cursor\s*=\s*["\x27]pointer'
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...