Caminho Loader Powershell Steganography Extraction

Tim Peck@timpeck

•updated Oct 23, 2025•0•99

Detects PowerShell execution patterns consistent with the Caminho Loader, which uses LSB steganography to extract a payload from a downloaded image file. This rule requires PowerShell Script Block Logging (Event ID 4104).