Steganography: Appending Zip to Image File via 'cat' Command
This rule detects the execution of the 'cat' command used to append a zip file to an image file. This technique is commonly used in steganography to hide data within seemingly innocuous files. The rule specifically looks for 'cat' being executed with two arguments: one ending in a common image file extension ('.jpg' or '.png') and another ending in '.zip'. This pattern suggests an attempt to concatenate the contents of a zip file onto an image file.
Sigma
