Script engine invoked with an SVG file on its command line

Siemphony@siemphonymediumT1027.017unverifiedPlaybook · Defence evasion

AN1407's real shape is a file-write followed within MITRE's TimeWindow by script-engine execution, network callback or credential collection — a three-stage correlation Sigma cannot express in one event. What survives to a single process_creation record is the deviation this rule matches instead: an SVG, an image format with no legitimate reason to be fed to a script host, on the command line of wscript.exe, cscript.exe, mshta.exe or rundll32.exe. The file-extension gate is MITRE's FileExtensionPattern knob restricted to .svg and .svgz; ParentProcessWhitelist has no expression here because the rule gates on the argument rather than on what launched the engine. A hit shows a script host was pointed at an SVG, not that the SVG carried a script tag or that anything fired afterwards — confirming smuggled content requires opening the file, which this event never does — a genuine, unmodified icon and a smuggled payload are indistinguishable at this level. The gate is also purely lexical, so an SVG fetched from an extensionless route or a query-string path (http://host/asset?id=1), or renamed on disk before invocation, leaves nothing for it to match. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0510, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Script engine invoked with an SVG file on its command line2id: 64ab9e70-032b-4725-aa2c-651b160ec9fb3status: experimental4description: |5  AN1407's real shape is a file-write followed within MITRE's TimeWindow by6  script-engine execution, network callback or credential collection — a7  three-stage correlation Sigma cannot express in one event. What survives to a8  single process_creation record is the deviation this rule matches instead: an9  SVG, an image format with no legitimate reason to be fed to a script host, on10  the command line of wscript.exe, cscript.exe, mshta.exe or rundll32.exe. The11  file-extension gate is MITRE's FileExtensionPattern knob restricted to .svg12  and .svgz; ParentProcessWhitelist has no expression here because the rule13  gates on the argument rather than on what launched the engine. A hit shows a14  script host was pointed at an SVG, not that the SVG carried a script tag or15  that anything fired afterwards — confirming smuggled content requires opening16  the file, which this event never does — a genuine, unmodified icon and a17  smuggled payload are indistinguishable at this level. The gate is also purely18  lexical, so an SVG fetched from an extensionless route or a query-string path19  (http://host/asset?id=1), or renamed on disk before invocation, leaves nothing20  for it to match.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0510, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T1027/01724  - https://attack.mitre.org/detectionstrategies/DET051025author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1627tags:28  - attack.defense-evasion29  - attack.t1027.01730logsource:31  category: process_creation32  product: windows33detection:34  selection_engine:35    Image|endswith:36      - '\wscript.exe'37      - '\cscript.exe'38      - '\mshta.exe'39      - '\rundll32.exe'40  selection_svg_arg:41    CommandLine|contains:42      - '.svg'43      - '.svgz'44  condition: selection_engine and selection_svg_arg45falsepositives:46  - "Legitimate SVG open, preview or conversion via a script wrapper — for example a help-desk or documentation tool shelling out to wscript.exe against C:\\tools\\svgviewer\\open.vbs icons.svg to preview a genuine, unmodified icon, or an asset build pipeline invoking rundll32 or wscript against a path or argument that contains '.svg' as a normal batch-conversion step. This is indistinguishable from smuggled content at the process_creation level because the event never inspects file content."47  - "HTA-based installers and setup wizards that hardcode a path to an .svg logo or icon in their mshta.exe command line for branding, a cosmetic reference with no script content involved."48  - "Design and publishing automation that shells out to rundll32 or a wscript helper to batch-convert or rasterize .svg assets as a normal step in a release or documentation pipeline."49level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe") and (ProcessCommandLine contains ".svg" or ProcessCommandLine contains ".svgz"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe") AND (CommandLine="*.svg*" OR CommandLine="*.svgz*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe") AND (TO_LOWER(process.command_line) LIKE "*.svg*" OR TO_LOWER(process.command_line) LIKE "*.svgz*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(\.svg|\.svgz)</field>    <description>Script engine invoked with an SVG file on its command line</description>    <mitre>      <id>T1027.017</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 64ab9e70-032b-4725-aa2c-651b160ec9fb

ATT&CKT1027.017

T1027.017SVG Smuggling

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.017, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add additional conditions to filter out known legitimate processes or command line arguments
Implement a whitelist of approved script engines and SVG files to reduce false positives
Modify the selection_svg_arg condition to look for more specific patterns or anomalies in the command line arguments

Declared by the author

Legitimate SVG open, preview or conversion via a script wrapper — for example a help-desk or documentation tool shelling out to wscript.exe against C:\tools\svgviewer\open.vbs icons.svg to preview a genuine, unmodified icon, or an asset build pipeline invoking rundll32 or wscript against a path or argument that contains '.svg' as a normal batch-conversion step. This is indistinguishable from smuggled content at the process_creation level because the event never inspects file content.
HTA-based installers and setup wizards that hardcode a path to an .svg logo or icon in their mshta.exe command line for branding, a cosmetic reference with no script content involved.
Design and publishing automation that shells out to rundll32 or a wscript helper to batch-convert or rasterize .svg assets as a normal step in a release or documentation pipeline.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects the invocation of script engines, such as wscript.exe, cscript.exe, mshta.exe, and rundll32.exe, with an SVG file on their command line. The presence of an SVG file as an argument to these script engines is unusual, as SVG files are typically associated with graphical rendering, and may indicate an attempt to execute obfuscated payloads.

02 · Telemetry you need

Log source: process creation events
Specific fields: Image (process image path), CommandLine (command line arguments)
Audit setting: process creation events must be audited, which may be off by default in some environments

03 · How the logic works

The rule selects process creation events where the image path ends with specific script engine executables (wscript.exe, cscript.exe, mshta.exe, or rundll32.exe). It then checks if the command line arguments of these processes contain the strings .svg or .svgz, indicating the presence of an SVG file. If both conditions are met, the rule triggers, suggesting potential obfuscated payload execution.

04 · Common false positives

Graphic design or web development software that uses script engines to render or manipulate SVG files
Legitimate administrative scripts that use SVG files for reporting or visualization purposes
Software installation or update processes that utilize script engines and SVG files for graphical rendering

05 · Detection maturity

tier_1: The rule as written may generate a high volume of false positives due to its broad detection criteria.
tier_2: With tuning, such as adding whitelists or filtering out legitimate processes, the rule can become more effective at detecting obfuscated payloads.
tier_3: Correlating this rule with other signals, such as network traffic or system calls, can help to further reduce false positives and improve detection accuracy.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/64ab9e70-032b-4725-aa2c-651b160ec9fb

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script engine invoked with an SVG file on its command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it