Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Detects embeding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.

Detects appending of zip file to image

Detects extracting of zip file from image file