Linux Auditd: Detect steghide File Embedding via embed Command

Flags steghide embed usage with -cf/-ef on Linux from auditd EXECVE events.

FreeUnreviewedSigmalowv1

linux-auditd-detect-steghide-file-embedding-via-embed-command-ce446a9e

title: "Linux Auditd: Detect steghide File Embedding via embed Command"
id: c191c9ec-6248-4651-b6d0-2eb93d8ab9db
status: test
description: This rule identifies execution of the steghide binary on Linux where the embed subcommand is used with file-path related flags (-cf and -ef). Hiding data inside media can help adversaries conceal sensitive information and reduce the likelihood that such content is noticed during casual inspection. The detection relies on auditd/EXECVE telemetry capturing the steghide command-line arguments.
references:
  - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_steghide_embed_steganography.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-11
modified: 2022-10-09
tags:
  - attack.stealth
  - attack.t1027.003
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: steghide
    a1: embed
    a2:
      - -cf
      - -ef
    a4:
      - -cf
      - -ef
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: ce446a9e-30b9-4483-8e38-d2c9ad0a2280
    type: derived

What it detects

This rule identifies execution of the steghide binary on Linux where the embed subcommand is used with file-path related flags (-cf and -ef). Hiding data inside media can help adversaries conceal sensitive information and reduce the likelihood that such content is noticed during casual inspection. The detection relies on auditd/EXECVE telemetry capturing the steghide command-line arguments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.