Linux steghide steganography: Extract hidden files from JPG/PNG
Detects steghide extracting embedded data from image files (.jpg/.png) on Linux.
- Product
- linux
- Service
- auditd
- Author
- Pawel Mazur (SigmaHQ), DRL 1.1
- Published
- 2021-09-11
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process executions of the steghide binary on Linux where the command line indicates an "extract" operation targeting image files ending in .jpg or .png. Attackers may use steganography extraction to retrieve hidden or concealed information while blending activity into seemingly normal file-handling workflows. Telemetry relies on auditd EXECVE events capturing the executable name and command-line arguments including the -sf option and image file extensions.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux steghide steganography: Extract hidden files from JPG/PNG"
id: f57ff057-c266-447d-b7d2-6b51fa8e7119
status: test
description: This rule matches process executions of the steghide binary on Linux where the command line indicates an "extract" operation targeting image files ending in .jpg or .png. Attackers may use steganography extraction to retrieve hidden or concealed information while blending activity into seemingly normal file-handling workflows. Telemetry relies on auditd EXECVE events capturing the executable name and command-line arguments including the -sf option and image file extensions.
references:
- https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_steghide_extract_steganography.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-11
modified: 2022-10-09
tags:
- attack.stealth
- attack.t1027.003
logsource:
product: linux
service: auditd
detection:
selection:
type: EXECVE
a0: steghide
a1: extract
a2: -sf
a3|endswith:
- .jpg
- .png
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: a5a827d9-1bbe-4952-9293-c59d897eb41b
type: derived