Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionlowtest

Steganography Unzip Hidden Information From Picture File

Detects extracting of zip file from image file

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Pawel MazurCreated Thu Sep 09Updated Sun Oct 09edd595d7-7895-4fa7-acb3-85a18a8772calinux
Log Source
Linuxauditd
ProductLinux← raw: linux
Serviceauditd← raw: auditd
Detection Logic
Detection Logic2 selectors
detection:
    commands:
        type: EXECVE
        a0: unzip
    a1:
        a1|endswith:
            - '.jpg'
            - '.png'
    condition: commands and a1
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
zerotoroot.me
MITRE ATT&CK
Rule Metadata
Rule ID
edd595d7-7895-4fa7-acb3-85a18a8772ca
Status
test
Level
low
Type
Detection
Created
Thu Sep 09
Modified
Sun Oct 09
Author
Pawel Mazur
Path
rules/linux/auditd/execve/lnx_auditd_unzip_hidden_zip_files_steganography.yml
Raw Tags
attack.defense-evasionattack.t1027.003
View on GitHub