Linux steghide steganography extraction via steghide extract targeting JPG/PNG

title: Linux steghide steganography extraction via steghide extract targeting JPG/PNG
id: f57ff057-c266-447d-b7d2-6b51fa8e7119
status: test
description: This rule flags Linux process executions where the steghide binary is run with the extract command and the -sf option pointing to a file ending in .jpg or .png. Attackers can use steganography tools like steghide to conceal payloads within images, making hidden information harder to detect through standard file inspection. The detection relies on auditd EXECVE telemetry capturing the executed program and its command-line arguments.
references:
  - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_steghide_extract_steganography.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-11
modified: 2022-10-09
tags:
  - attack.stealth
  - attack.t1027.003
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: steghide
    a1: extract
    a2: -sf
    a3|endswith:
      - .jpg
      - .png
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: a5a827d9-1bbe-4952-9293-c59d897eb41b
    type: derived