T1027.017 — SVG Smuggling

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files. SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `<script>` tags that enable adversaries to…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.017 Obfuscated Files or Information: SVG Smuggling

title: "T1027.017 Obfuscated Files or Information: SVG Smuggling"
id: a8d7179e-59a5-4b64-967d-e85b1a81192e
description: 'Detects creation of SVG files by browser or mail-client processes as a delivery-stage proxy for SVG smuggling, since Sysmon file-creation telemetry cannot inspect embedded <script> tag content inside the SVG. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, ParentProcessWhitelist, FileExtensionPattern.'
references:
  - https://attack.mitre.org/techniques/T1027/017
author: Shahrukh Khan
date: 2026-03-09
license: MIT
tags:
  - attack.stealth
  - attack.t1027.017

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|endswith: '.svg'
  selection_delivery_process:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\outlook.exe'
      - '\thunderbird.exe'
      - '\iexplore.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_delivery_process and not filter_system_account

falsepositives:
  - Legitimate SVG downloads/attachments saved by browsers or mail clients; this rule cannot see file content (script tags) so any SVG write by these processes will match — tune with ParentProcessWhitelist and a download-path allowlist.

level: medium

T1027.017 Obfuscated Files or Information: SVG Smuggling

title: "T1027.017 Obfuscated Files or Information: SVG Smuggling"
id: e477d2da-f22f-49d1-82c9-5ebaad94cf46
description: 'Detection Strategy for SVG Smuggling with Script Execution and Delivery Behavior. The smuggled JavaScript payload executes inside the browser''s rendering engine and is never observable via auditd; the previous rule flagged creation of any .svg file anywhere, which fires on ordinary image saves/edits with zero specificity. As the closest defensible Linux-observable proxy, this rule scopes SVG creation to the paths where browser downloads and mail-client attachments actually land (Downloads, /tmp, Thunderbird/Firefox/Chrome/Chromium profile and cache directories), which is still coarse but at least reflects delivery-path context rather than matching every SVG on the filesystem. Tune using: TargetPaths, ExecutionContext, NetworkDestinations.'
references:
  - https://attack.mitre.org/techniques/T1027/017
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.stealth
  - attack.t1027.017

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|endswith: '.svg'
  selection_delivery_path:
    name|contains:
      - '/Downloads/'
      - '/tmp/'
      - '/.thunderbird/'
      - '/.mozilla/firefox/'
      - '/.cache/google-chrome/'
      - '/.cache/chromium/'
  condition: selection and selection_delivery_path

falsepositives:
  - SVG smuggling payload decoding happens inside the browser's rendering engine and is not observable via auditd; this still only flags SVG file creation in common download/attachment-staging locations (legitimate downloads, image assets saved from the web, browser cache writes), which remains far more common than actual malicious use.

level: informational

T1027.017 Obfuscated Files or Information: SVG Smuggling

title: "T1027.017 Obfuscated Files or Information: SVG Smuggling"
id: 2c7a5c9b-a71b-42ee-9cbb-3ca898b36326
description: 'Detection Strategy for SVG Smuggling with Script Execution and Delivery Behavior. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptEngines, UserContext, EmbeddedContentIndicators.'
references:
  - https://attack.mitre.org/techniques/T1027/017
author: Shahrukh Khan
date: 2026-06-23
license: MIT
tags:
  - attack.stealth
  - attack.t1027.017

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/Safari'
      - '/Google Chrome'
  selection_shell:
    Image|endswith:
      - '/bash'
      - '/python3'
      - '/osascript'
  condition: selection and selection_shell

falsepositives:
  - Browser extensions or helper applications that legitimately spawn scripting engines for automation tasks.

level: medium

Related sub-techniques

Explore