PowerShell Steganography Payload Extraction (APT29)

Tim Peck@timpeck

•updated Apr 8, 2026•10•0•243

This rule detects the execution of PowerShell commands that utilize .NET's System.Drawing.Bitmap class and the .GetPixel method. This combination is indicative of steganography techniques being used to extract hidden data, often malicious payloads, from image files. This specific pattern has been associated with APT29.