huntrule

Linux steghide steganography: Extract hidden files from JPG/PNG

Detects steghide extracting embedded data from image files (.jpg/.png) on Linux.

FreeReviewedSigma · Low · v3
Product
linux
Service
auditd
Author
Pawel Mazur (SigmaHQ), DRL 1.1
Published
2021-09-11
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches process executions of the steghide binary on Linux where the command line indicates an "extract" operation targeting image files ending in .jpg or .png. Attackers may use steganography extraction to retrieve hidden or concealed information while blending activity into seemingly normal file-handling workflows. Telemetry relies on auditd EXECVE events capturing the executable name and command-line arguments including the -sf option and image file extensions.

Reporting behind it

Related detections5 linkedT1027.003 — drag to rearrange
Malicious LSB Steganography Image Decoding via PowerShell (via ps_script)
Linux auditd: Steghide embeds hidden files via steghide embed with -cf/-ef
Linux auditd: cat appends ZIP data to image files
Linux auditd: Unzip files extracted from JPG/PNG images
Windows findstr Launches .lnk via Command Line
Linux steghide steganography: Extract hidden files from JPG/PNG
Pivot detection · T1027.003 · 5 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.