Sublime Security high experimental mql

Attachment: SVG files with evasion elements

This rule identifies incoming SVG vector graphics files containing specific patterns: circle elements combined with either embedded images, hyperlinks, QR codes, or filenames that match recipient information. Limited to three attachments. SVG circle elements have been used to obfuscate QR codes and bypass automated QR code scanning methods.

View Source

Detection Logic

type.inbound
and length(attachments) < 4
and any(attachments,
        (
          .file_extension == "svg"
          or .content_type in ("image/svg+xml")
          or .file_type == "svg"
        )
        and any(file.explode(.),
                any(.scan.xml.tags, . == "circle")
                and 1 of (
                  any(.scan.xml.tags, . in ("image", "a")),
                  .scan.qr.data is not null,
                  any(recipients.to,
                      strings.icontains(..file_name, .email.local_part)
                  ),
                  any(recipients.to,
                      strings.icontains(..file_name, .email.domain.sld)
                  )
                )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...