SilentCanvas - JPEG Disguised PowerShell Loader

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•3

This rule detects PowerShell executing a payload deceptively named as a JPEG image file, specifically 'sysupdate.jpeg', followed by subsequent outbound network activity. This behavior is indicative of the SilentCanvas campaign.