tfMITRE ATT&CK sub-technique

SVG Smuggling T1027.017

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 25 March 2025
Last modified: 12 May 2026
Contributors: Dhiraj Mishra (@RandomDhiraj); Suraj Khetani (@r00treaver)

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.[1] SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include <script> tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1027.017

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

SVG Smuggling detection strategy DET0510

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for SVG Smuggling with Script Execution and Delivery Behavior

Enterprise

3 platforms

AN1407 · Windows

Detects suspicious SVG file creation or download events followed by script engine execution (e.g., wscript.exe, mshta.exe, rundll32.exe), network callbacks, or browser-based credential collection.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Threshold between SVG file write and script execution (e.g., < 60s)
ParentProcessWhitelist	Allowlisted script engines that may invoke browsers or JS in benign cases
FileExtensionPattern	Regex or string match for .svg, .svgz, or embedded .svg inside HTML or PDF

AN1408 · Linux

Detects downloaded SVG files followed by execution of browser processes or tools like xdg-open, and rapid follow-on network connections or process spawns to interpreters like python or bash.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File ModificationDC0061	auditd:SYSCALL	open, write
Network Traffic ContentDC0085	NSM:Flow	Outbound HTTP/S

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetPaths	Suspicious write locations such as /tmp/, ~/Downloads/
ExecutionContext	Processes spawned by browsers or svg-viewing apps that invoke interpreters
NetworkDestinations	URLs/IPs contacted post-SVG access – may reflect initial C2

AN1409 · macOS

Detects SVGs downloaded via browser that invoke AppleScript, osascript, or JavaScriptCore processes, followed by network egress or file drop to LaunchAgents or ~/Library.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
Network Traffic ContentDC0085	macos:unifiedlog	subsystem: com.apple.WebKit or com.apple.WebKit.Networking

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptEngines	Scriptable binaries such as osascript, jsc, JavaScriptCore – may vary by OS version
UserContext	Restrict to non-system users or only specific login sessions
EmbeddedContentIndicators	SVGs embedded inside PDFs or HTML with script-based triggers

SVG Smuggling detections T1027.017

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs