Script engine invoked with an SVG file on its command line

Siemphony@siemphonymediumT1027.017unverified

AN1407's real shape is a file-write followed within MITRE's TimeWindow by script-engine execution, network callback or credential collection — a three-stage correlation Sigma cannot express in one event. What survives to a single process_creation record is the deviation this rule matches instead: an SVG, an image format with no legitimate reason to be fed to a script host, on the command line of wscript.exe, cscript.exe, mshta.exe or rundll32.exe. The file-extension gate is MITRE's FileExtensionPattern knob restricted to .svg and .svgz; ParentProcessWhitelist has no expression here because the rule gates on the argument rather than on what launched the engine. A hit shows a script host was pointed at an SVG, not that the SVG carried a script tag or that anything fired afterwards — confirming smuggled content requires opening the file, which this event never does — a genuine, unmodified icon and a smuggled payload are indistinguishable at this level. The gate is also purely lexical, so an SVG fetched from an extensionless route or a query-string path (http://host/asset?id=1), or renamed on disk before invocation, leaves nothing for it to match. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0510, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\rundll32.exe") and (ProcessCommandLine contains ".svg" or ProcessCommandLine contains ".svgz"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe") AND (CommandLine="*.svg*" OR CommandLine="*.svgz*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe") AND (TO_LOWER(process.command_line) LIKE "*.svg*" OR TO_LOWER(process.command_line) LIKE "*.svgz*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(\.svg|\.svgz)</field>    <description>Script engine invoked with an SVG file on its command line</description>    <mitre>      <id>T1027.017</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 64ab9e70-032b-4725-aa2c-651b160ec9fb

ATT&CKT1027.017

T1027.017SVG Smuggling

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloads

01 · What this rule detects

Content made deliberately unreadable before it runs — a base64 or hex blob passed on a command line, a script assembled from concatenated fragments, a packed or encrypted file on disk, and the decode step that has to happen before any of it executes. The obfuscation itself is not the finding; the transition from encoded to executed is. Guardrailed payloads belong here too, where the key is derived from the victim's domain or hostname so the content only decodes on the intended machine and never in your sandbox.

02 · Telemetry you need

Sysmon EventID 1 CommandLine, ParentImage and OriginalFileName, complete and untruncated — Security 4688 needs Audit Process Creation for the event and the separate 'Include command line in process creation events' policy for the arguments, and without the second one you get the image name and none of the encoding
PowerShell script block logging (EventID 4104), which records the content after decoding — off by default, and long blocks are split across several events with MessageNumber and MessageTotal, so a contains match on one event misses any string that straddles the split
Sysmon EventID 11 (FileCreate) for the decoded payload written to disk and EventID 7 (ImageLoad) for what is loaded straight afterwards — a reflectively loaded module produces no EventID 7 at all, so absence here proves nothing
auditd execve records on Linux — the rule must be loaded in /etc/audit/rules.d or nothing is captured, and any argument containing whitespace or non-printable characters is written hex-encoded rather than as text, so a match written against the plaintext string silently never fires
Antimalware Scan Interface telemetry where your endpoint product exposes it: it sees the buffer after decoding, but only for the runtimes that call it — PowerShell, the Windows Script Host, VBA and .NET — never a native loader

03 · How the logic works

Start with the trap, because it is the reason most rules in this category are unusable: base64 on a command line is overwhelmingly benign. Installers pass encoded configuration, telemetry agents pass encoded payloads, deployment tooling ships whole scripts as -EncodedCommand, and scheduled tasks are registered with base64 arguments by products nobody considers suspicious. 'Contains base64' and 'high entropy' are therefore not detections — entropy measures compressibility, not intent, and certificates, GUIDs, JWTs, minified JavaScript and packed commercial binaries all score exactly as high as a packed implant. Entropy is a ranking signal for triage, not a firing condition.

What makes it a detection is base64 plus a decode-and-execute pair in the same command line or the same script block: FromBase64String alongside Invoke-Expression, IEX or .Invoke(); certutil -decode followed by execution of what it wrote; base64 -d piped into sh or bash; eval over a decoded string. Match the pair, not the blob. One useful specific: -EncodedCommand payloads are UTF-16LE before encoding, so a decoded ASCII keyword appears as a predictable base64 fragment — but the fragment depends on the byte offset the string starts at, so you need all three alignments of each keyword or the match is a coin flip.

The second family is character-level obfuscation rather than encoding: carets in cmd, backticks and the format operator in PowerShell, %VAR:~n,m% substring expansion, quotes inserted mid-token, variables assembled and then invoked. Match density rather than presence. One caret is a normal escape; fifteen carets in one command line is not a command line anyone typed. Finally, execution guardrails cap what any of this can achieve: if the key is derived from the environment, you may never observe the decoded content at all, and the guardrail check is made of ordinary API calls that make a poor rule. That is an argument for keeping the file-write and image-load rules alongside the command-line ones, not for writing a rule against the guardrail.

04 · Common false positives

Intune, Configuration Manager and similar deployment platforms, which run detection and remediation scripts as -EncodedCommand by design — this is normally the single highest-volume match in the category
certutil -encode and -decode used by administrators and certificate enrolment scripts to move certificate material around as text
Monitoring, backup and inventory agents that register scheduled tasks with a base64 argument, then run them on a fixed schedule from every host in the estate
Minified and bundled JavaScript, source maps and web application build output, which trip entropy and long-string rules written against file content
Commercially packed and protected binaries — DRM wrappers, anti-cheat, licence protection — whose sections have the same entropy profile as a packer because they are one
Cloud and container CLI usage, where secrets, kubeconfigs and manifests are routinely base64 on the command line

05 · Detection maturity

Tier 1 — starting point: Matches -EncodedCommand and similar encoding flags, or a base64-shaped string, anywhere on a command line.
Tier 2 — tuned: Requires encoding together with a decode-and-execute pair or a high density of escape characters, with deployment tooling excluded by signed parent path.
Tier 3 — correlated: Reads the decoded content from script block logging or enrichment and scores on what the decoded command actually does, the parent chain, and whether the payload was written to disk or loaded in memory afterwards.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Require the pair: encoding plus a decode call plus an execution sink. A rule that fires on the encoding alone will be turned off within a week and will have taught the author that the category does not work
Exclude deployment tooling by the full signed path of the parent process, never by the encoded string — the string is the attacker's half and the parent is not
Match parameter prefixes case-insensitively and cover the dash variants: PowerShell accepts -e, -en, -enc and any longer prefix of -EncodedCommand, and Sigma's windash modifier handles the separator forms
Decode the blob during enrichment so the alert carries the plaintext — an alert that says only 'encoded command observed' hands the analyst the same work the rule was supposed to do
Use payload length as a cheap second condition; a several-thousand-character blob is a different population from a forty-character one, and the split is usually visible in a day of your own data
Where script block logging is enabled, make 4104 the primary source and keep the command-line rule as coverage for the runtimes 4104 cannot see — and account for the multi-event split when you write the match

Declared by the author

Legitimate SVG open, preview or conversion via a script wrapper — for example a help-desk or documentation tool shelling out to wscript.exe against C:\tools\svgviewer\open.vbs icons.svg to preview a genuine, unmodified icon, or an asset build pipeline invoking rundll32 or wscript against a path or argument that contains '.svg' as a normal batch-conversion step. This is indistinguishable from smuggled content at the process_creation level because the event never inspects file content.
HTA-based installers and setup wizards that hardcode a path to an .svg logo or icon in their mshta.exe command line for branding, a cosmetic reference with no script content involved.
Design and publishing automation that shells out to rundll32 or a wscript helper to batch-convert or rasterize .svg assets as a normal step in a release or documentation pipeline.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.017, evaluated against their process_creation events.

Share this rule

/u/siemphony/64ab9e70-032b-4725-aa2c-651b160ec9fb

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script engine invoked with an SVG file on its command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it