How do you detect SVG attachment phishing?

Detect SVG phishing by inspecting content and watching the endpoint. At the gateway or in YARA, flag SVG files with script elements or onload handlers combined with redirect code (window.location, location.href), base64 decoding, or foreignObject with an embedded form. On the endpoint, alert on a browser launched with an .svg argument from the Outlook cache or download paths, and correlate with a connection to a rare domain. Block or convert external SVG attachments and set the default .svg handler to an image viewer.

Detecting SVG Attachment Phishing

SVG is an XML format that supports script elements, event handlers and embedded HTML through foreignObject. On many systems a double-click opens the file in the default browser, where it runs as a page. Attackers use it to display a fake login, redirect to a harvesting site or assemble a download, while image filters treat the attachment as harmless.

Signals at a Glance

Signal	Where	ATT&CK
SVG attachment containing a script element, event handler or foreignObject	Email gateway	T1566.001
Redirect or location assignment inside an SVG	Gateway, YARA	T1566.001
Browser opening an .svg file from the Outlook attachment cache or Downloads	Sysmon 1, EDR	T1204.002
Browser opened from the mail client followed by a connection to a rare domain	EDR network, proxy	T1204.001
Embedded base64 payload and decoding code	Gateway, YARA	T1027.006

Inspecting the File

SVG with active content is rare in business mail, so the file content itself is a good detection. Scan for scripting markers rather than for the file name:

rule hunt_svg_active_content
{
  meta:
    description = "SVG file containing script, redirect or embedded HTML markers"
    note = "hunting rule - validate against your corpus; design tools and web teams send benign SVG"
  strings:
    $svg = "<svg" nocase
    $s1 = "<script" nocase
    $s2 = "onload=" nocase
    $s3 = "<foreignObject" nocase
    $r1 = "window.location" nocase
    $r2 = "location.href" nocase
    $r3 = "document.location" nocase
    $d1 = "atob(" nocase
    $f1 = "<form" nocase
  condition:
    $svg and filesize < 2MB and
    ( ($s1 or $s2) and (1 of ($r*) or $d1) or ($s3 and $f1) )
}

Browser-Launched SVG

When a user opens an SVG attachment, the default browser starts with the file path as an argument. A browser launched from the mail client or a user path with an .svg argument is the endpoint twin of the gateway rule:

title: Browser Opens SVG File From Mail Cache or Downloads
logsource:
  product: windows
  category: process_creation
detection:
  browser:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  svg:
    CommandLine|contains: '.svg'
  path:
    CommandLine|contains:
      - 'Content.Outlook'
      - '\Downloads\'
      - '\AppData\Local\Temp\'
  condition: browser and svg and path
level: medium
# tune/validate: designers opening local SVG will match; join with an outbound connection to a rare domain to raise confidence.

Block SVG attachments from external senders where the business allows, or convert them to a static image at the gateway.
Change the default file association for .svg to an image viewer on managed endpoints so a double-click does not run it in a browser.
Treat an SVG that causes a browser to contact a newly registered domain as a phishing indicator and hand the domain to your landing-page detection.

Vetted sources

Use SigmaHQ browser and file-extension rules, Elastic's attachment and browser child-process detections, your gateway vendor's guidance on active-content attachments and public SVG phishing write-ups for sample structure. Baseline your own environment — marketing and design teams legitimately exchange SVG files.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Inspecting the File

Browser-Launched SVG

Build Detections That Fire

Phishing Delivery Detection

Detection Hub

HTML Smuggling Detection

Phishing Landing Page Detection