Steganography: Unzip Hidden Information From Picture File

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

This rule detects the execution of the 'unzip' command where the target file has a common image file extension ('.jpg' or '.png'). This behavior is indicative of an attempt to extract hidden information, specifically a zip archive, from an image file, a technique often used in steganography for defense evasion or data exfiltration.