Linux auditd: Steghide embeds hidden files via steghide embed with -cf/-ef
Flags steghide embed usage with -cf/-ef on Linux from auditd EXECVE events.
- Product
- linux
- Service
- auditd
- Author
- Pawel Mazur (SigmaHQ), DRL 1.1
- Published
- 2021-09-11
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions of the steghide binary where the embed subcommand is used along with -cf and/or -ef options, indicating an attempt to hide data within an image or container. Such behavior matters because steganography can conceal sensitive contents and reduce the likelihood of simple content-based inspection. The detection relies on Linux auditd telemetry capturing process execution events (execve) and the command-line arguments for steghide.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux auditd: Steghide embeds hidden files via steghide embed with -cf/-ef"
id: c191c9ec-6248-4651-b6d0-2eb93d8ab9db
status: test
description: This rule identifies executions of the steghide binary where the embed subcommand is used along with -cf and/or -ef options, indicating an attempt to hide data within an image or container. Such behavior matters because steganography can conceal sensitive contents and reduce the likelihood of simple content-based inspection. The detection relies on Linux auditd telemetry capturing process execution events (execve) and the command-line arguments for steghide.
references:
- https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_steghide_embed_steganography.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-11
modified: 2022-10-09
tags:
- attack.stealth
- attack.t1027.003
logsource:
product: linux
service: auditd
detection:
selection:
type: EXECVE
a0: steghide
a1: embed
a2:
- -cf
- -ef
a4:
- -cf
- -ef
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: ce446a9e-30b9-4483-8e38-d2c9ad0a2280
type: derived