Steganography Extract Files with Steghide

 1title: Steganography Extract Files with Steghide
 2id: a5a827d9-1bbe-4952-9293-c59d897eb41b
 3status: test
 4description: Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.
 5references:
 6    - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/
 7author: 'Pawel Mazur'
 8date: 2021-09-11
 9modified: 2022-10-09
10tags:
11    - attack.defense-evasion
12    - attack.t1027.003
13logsource:
14    product: linux
15    service: auditd
16detection:
17    selection:
18        type: EXECVE
19        a0: steghide
20        a1: extract
21        a2: '-sf'
22        a3|endswith:
23            - '.jpg'
24            - '.png'
25    condition: selection
26falsepositives:
27    - Unknown
28level: low

References

• How to Hide Confidential Files in Images on Debian using Steganography

  

  Sometimes we have to hide our data to protect it from third-party access to the system. However, one way to achieve this is through encryption. But today we are going to talk about another method, ...

  
  Read More

Related rules

• Findstr Launching .lnk File
• Steganography Hide Files with Steghide
• Steganography Hide Zip Information in Picture File
• Steganography Unzip Hidden Information From Picture File
• AD Object WriteDAC Access