Steganographic PNG extraction via certutil/findstr cache-size matching
Detects potential steganographic data extraction by monitoring for command-line usage of certutil.exe or findstr.exe associated with specific file size markers (304204 bytes) or URL patterns (stego-image.png?sid=) often used in browser-cached file extraction, specifically linked to DOUBLECUP Stage 1 activity.
Microsoft Sentinel (KQL)
