Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
70 detections
Filters
Last updated
All Time
Detection languages
19
17
15
6
6
Contributors
22
10
9
5
5
Categories
24
20
15
14
13
Platforms
54
13
6
4
Products / Services
18
12
8
6
4
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
6
IDS Protocols
5
1
Detects outbound HTTP POST requests that contain a JPEG file signature ('FF D8 FF') in the body but lack a 'Content-Type' header. This pattern is indicative of potential C2 communication from a loader or malware family attempting to exfiltrate or receive data disguised as an image file while bypassing basic header-based inspection.
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
Detects the use of PowerShell or Windows Script Host to access files within common web browser cache directories combined with indicators of Base64 decoding and pixel data manipulation. This behavior is indicative of extracting malicious payloads hidden via steganography within browser-cached image files, a technique often used in phishing campaigns to evade detection.
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
This rule detects potential web shells that employ steganographic techniques by embedding malicious executable script code within image file structures (JPG or PNG). It specifically flags files containing common web shell markers 'ONEPIECE' or 'x_best_911' in combination with embedded script tags (e.g., <script, eval, <%, <?php) within files identified as having image magic bytes.
Detects a loader module and a corresponding RIFF/WAVE file that utilizes steganography to conceal a secondary malicious payload. The loader extracts the payload from the WAV file using specific offsets and XOR decoding, then executes it in memory. This pattern is characteristic of a DLL sideloading chain involving WMPCL.dll and WPFLocalizeExtension.dll.
Detects ZIP archives exceeding 100MB that contain specific DLL filenames often used for junk-padding to evade sandbox analysis. This technique is observed in brand-impersonation campaigns targeting users with fake security or authentication software lures.
Detects the presence of PNG image files containing a specific steganographic marker embedded within the iTXt metadata chunk, often used by the LausivLoader malware for C2 communication or payload delivery. The rule looks for the specific marker 0xFF89AD4A or known C2 indicators (yapw.life, stego_zrgaixkku8.png) within PNG files.
Detects the presence of PNG image files containing a specific steganographic marker embedded within the iTXt metadata chunk, often used by the LausivLoader malware for C2 communication or payload delivery. The rule looks for the specific marker 0xFF89AD4A or known C2 indicators (yapw.life, stego_zrgaixkku8.png) within PNG files.
Detects HTTP GET requests to a specific URL path containing an image file, which is associated with the delivery of the LausivLoader malware. The rule monitors for external connections to the domain 'yapw.life' requesting a PNG file, a technique often used for steganographic payload delivery.
This rule detects either the presence of known malicious image files (based on SHA256 hashes) on a device or network connection attempts to known malicious URLs hosting such files. This pattern is commonly associated with steganographic techniques used to hide malicious payloads within image files for C2 or delivery.
Detects network activity associated with the PureLogs Stealer, specifically connections to identified infrastructure hosting payloads on Pixeldrain and attempts to retrieve steganographic payloads via specific API endpoints.
Detects the DOUBLECUP/ClickFix loader activity which involves a sequence of suspicious command-line execution patterns. The rule correlates three specific behaviors occurring within a 5-minute window: finding PowerShell paths using 'where', searching for the 'ZZ1984' marker using 'findstr', and executing a minimized background command process. This combination is highly indicative of the ClickFix delivery chain used to trick users into running malicious commands.
Detects process self-deletion (executable, scheduled task, or install directory) correlated within 60 minutes to a matching prior creation event, indicating post-execution cleanup behavior consistent with loader/RAT install-then-delete patterns such as those used by DOUBLECUP-delivered payloads.
Detects potential steganographic data extraction by monitoring for command-line usage of certutil.exe or findstr.exe associated with specific file size markers (304204 bytes) or URL patterns (stego-image.png?sid=) often used in browser-cached file extraction, specifically linked to DOUBLECUP Stage 1 activity.
Detects scripts combining a certutil -decode (or equivalent decode) command, a reference to the cached stego-image.png, and the ZZ1984 embedded marker string used by DOUBLECUP to extract steganographic payloads from PNG images via LSB extraction
This rule detects malicious activity associated with the DOUBLECUP/CountLoader malware by correlating specific PowerShell execution patterns within a single process lineage. It flags process sequences where an encoded PowerShell command (using -enc or -encodedcommand) occurs in conjunction with suspicious .NET reflection (System.Reflection.Assembly) or ScriptBlock invocation within a 5-minute window. The rule explicitly excludes processes with valid digital signatures to reduce false positives from legitimate administrative software.
Detects the DOUBLECUP ClickFix loader execution chain where cmd.exe uses a 'for /f' loop with 'where pow?r?hell.exe' wildcard lookup, 'findstr' searching for the ZZ1984 marker, and a minimized 'start /min cmd /c' relaunch, consistent with steganographic PNG cache extraction and CountLoader/DeviceManager RAT delivery.
PowerShell Downloading JPEG Image Possible Steganographic Payload Carrier
Detects an outbound HTTP GET request containing a .jpg extension in the URI, initiated by a user agent string containing 'PowerShell'. This pattern is commonly associated with attackers downloading images intended to serve as carriers for steganographic payloads, which are then parsed or executed by malicious PowerShell scripts.
Detects PowerShell scripts containing logic indicative of extracting payloads hidden via steganography (e.g., LSB or channel-based extraction from pixel data) combined with memory-based decryption. This behavior is commonly associated with stealthy malware loaders attempting to reconstruct malicious code from image files.
Page 1 of 4