Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)

Hunt Hypothesis

This hunt targets adversaries leveraging malicious, lightweight SVG files to initiate external network connections, mimicking the initial infection vector observed in CryptoWall ransomware campaigns. Proactively searching for this behavior within Azure Sentinel is critical because these small file sizes often evade traditional signature-based defenses, allowing attackers to establish command-and-control channels before broader detection mechanisms trigger.

YARA Rule

rule SVG_LoadURL {
	meta:
		description = "Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)"
		author = "Florian Roth"
		reference = "http://goo.gl/psjCCc"
		date = "2015-05-24"
		hash1 = "ac8ef9df208f624be9c7e7804de55318"
		hash2 = "3b9e67a38569ebe8202ac90ad60c52e0"
		hash3 = "7e2be5cc785ef7711282cea8980b9fee"
		hash4 = "4e2c6f6b3907ec882596024e55c2b58b"
		score = 50
	strings:
		$s1 = "</svg>" nocase
		$s2 = "<script>" nocase
		$s3 = "location.href='http" nocase
	condition:
		all of ($s*) and filesize < 600
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• http://goo.gl/psjCCc
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Tiny SVG with Embedded URL” detection rule, including suggested filters and exclusions:

• Microsoft Teams/Outlook Meeting Invitations

  • Scenario: When a user receives a calendar invite or a meeting reminder via Microsoft Outlook or Microsoft Teams, the application often generates a temporary, lightweight SVG file (approx. 2–5 KB) containing an embedded hyperlink to the meeting join URL or the company logo. This triggers the rule because the SVG size is minimal and contains an external href attribute pointing to a legitimate corporate domain (e.g., teams.microsoft.com).
  • Suggested Filter: Exclude SVG files where the embedded URL points to known internal domains (*.company.local, *.microsoftonline.com) AND the file size is under 10 KB. Additionally, filter by process name OUTLOOK.EXE or TEAMS.EXE.

• Automated Dashboard Reporting (Power BI / Tableau)

  • Scenario: Scheduled reporting jobs using tools like Microsoft Power BI or Tableau often export dashboard snapshots as SVG files to be emailed to stakeholders or stored in a shared drive. These reports frequently include tiny “drill-through” icons or status indicators that are SVGs referencing external data sources or help documentation URLs. The file size is typically very small due to vector compression, mimicking the CryptoWall signature.
  • Suggested Filter: Create an exclusion for files generated by MSACCESS.EXE, POWERBIDESKTOP.EXE, or specific scheduled task processes (e.g., TASKSCHEDULER.exe running a PowerShell script) where the file extension is .svg and the parent directory matches known report output paths (e.g., C:\Reports\DailyOutput).

• IT Asset Management & Software Deployment Agents

  • Scenario: Enterprise deployment tools such as SCCM (Microsoft