Nimbus Manticore - Encoded Payload in BMP File (T1027)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•6

Detects the malware reading seemingly benign .bmp files from disk, which actually contain the steganographically encoded secondary payload. This rule specifically looks for a process accessing a .bmp file and then loading an image from the 'C:\Users\Public' folder, indicating a potential steganographic attack where a malicious payload is hidden within a benign image file.