Potentially malicious svg file delivered to Inbox

Description

This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox.

Query · kql

let SuspiciousDisplayNames = pack_array("Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "IT Support", "Helpdesk");
EmailAttachmentInfo
| where FileName contains ".svg" and FileType == "html" // SVG files which render as only an image will display FileType as Text, unless containing Javascript which displays FileType as Html
| join EmailEvents on NetworkMessageId
// | where SenderDisplayName has_any (SuspiciousDisplayNames) // Optionally remove comment to also evaluate and filter based on email display name
| where LatestDeliveryLocation == "Inbox/folder"
Raw source Potentially malicious svg file delivered to Inbox · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: ca777d68-fdd7-4f84-8c56-7c3af68f92d3
name: Potentially malicious svg file delivered to Inbox
description: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file has been delivered into an Inbox.
description-detailed: |
  This query can be used as a Custom Detection Rule (CDR) to trigger when a potentially malicious .SVG file containing JavaScript has been delivered into an Inbox. Allows granular control of SVG files, compared to adding type to Common Attachment Filter. https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
  - EmailAttachmentInfo
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  let SuspiciousDisplayNames = pack_array("Help Desk", "Help Desk Team", "Help Desk IT", "Microsoft Security", "IT Support", "Helpdesk");
  EmailAttachmentInfo
  | where FileName contains ".svg" and FileType == "html" // SVG files which render as only an image will display FileType as Text, unless containing Javascript which displays FileType as Html
  | join EmailEvents on NetworkMessageId
  // | where SenderDisplayName has_any (SuspiciousDisplayNames) // Optionally remove comment to also evaluate and filter based on email display name
  | where LatestDeliveryLocation == "Inbox/folder"
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.