Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1027.017sub-technique of T1027 Obfuscated Files or Information

SVG Smuggling

Linux · macOS · Windowsnothing on this site yetT1027.017 on attack.mitre.org

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files. SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `<script>` tags that enable adversaries to include malicious JavaScript payloads.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for SVG Smuggling with Script Execution and Delivery Behavior

  • Detects suspicious SVG file creation or download events followed by script engine execution (e.g., wscript.exe, mshta.exe, rundll32.exe), network callbacks, or browser-based credential collection.
  • Detects downloaded SVG files followed by execution of browser processes or tools like xdg-open, and rapid follow-on network connections or process spawns to interpreters like python or bash.
  • Detects SVGs downloaded via browser that invoke AppleScript, osascript, or JavaScriptCore processes, followed by network egress or file drop to LaunchAgents or ~/Library.

what reduces it

  • M1048 Application Isolation and Sandboxing. Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist.

the rest of T1027

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.