Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionlowtest

Steganography Hide Zip Information in Picture File

Detects appending of zip file to image

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Pawel MazurCreated Thu Sep 09Updated Sun Oct 0945810b50-7edc-42ca-813b-bdac02fb946blinux
Log Source
Linuxauditd
ProductLinux← raw: linux
Serviceauditd← raw: auditd
Detection Logic
Detection Logic3 selectors
detection:
    commands:
        type: EXECVE
        a0: cat
    a1:
        a1|endswith:
            - '.jpg'
            - '.png'
    a2:
        a2|endswith: '.zip'
    condition: commands and a1 and a2
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
zerotoroot.me
MITRE ATT&CK
Rule Metadata
Rule ID
45810b50-7edc-42ca-813b-bdac02fb946b
Status
test
Level
low
Type
Detection
Created
Thu Sep 09
Modified
Sun Oct 09
Author
Pawel Mazur
Path
rules/linux/auditd/execve/lnx_auditd_hidden_zip_files_steganography.yml
Raw Tags
attack.defense-evasionattack.t1027.003
View on GitHub