Add rule to detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)