AN1407
Analytic 1407
Windows
Detects suspicious SVG file creation or download events followed by script engine execution (e.g., wscript.exe, mshta.exe, rundll32.exe), network callbacks, or browser-based credential collection.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
[TimeWindow]
Threshold between SVG file write and script execution (e.g., < 60s)
[ParentProcessWhitelist]
Allowlisted script engines that may invoke browsers or JS in benign cases
[FileExtensionPattern]
Regex or string match for .svg, .svgz, or embedded .svg inside HTML or PDF
AN1408
Analytic 1408
Linux
Detects downloaded SVG files followed by execution of browser processes or tools like xdg-open, and rapid follow-on network connections or process spawns to interpreters like python or bash.
auditd:SYSCALL
open, write
auditd:SYSCALL
execve
NSM:Flow
Outbound HTTP/S
[TargetPaths]
Suspicious write locations such as /tmp/, ~/Downloads/
[ExecutionContext]
Processes spawned by browsers or svg-viewing apps that invoke interpreters
[NetworkDestinations]
URLs/IPs contacted post-SVG access – may reflect initial C2
AN1409
Analytic 1409
macOS
Detects SVGs downloaded via browser that invoke AppleScript, osascript, or JavaScriptCore processes, followed by network egress or file drop to LaunchAgents or ~/Library.
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
macos:unifiedlog
subsystem: com.apple.WebKit or com.apple.WebKit.Networking
[ScriptEngines]
Scriptable binaries such as osascript, jsc, JavaScriptCore – may vary by OS version
[UserContext]
Restrict to non-system users or only specific login sessions
[EmbeddedContentIndicators]
SVGs embedded inside PDFs or HTML with script-based triggers