Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
70 detections
Filters
Last updated
All Time
Detection languages
19
17
15
6
6
Contributors
22
10
9
5
5
Categories
24
20
15
14
13
Platforms
54
13
6
4
Products / Services
18
12
8
6
4
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
1
IDS Classtypes
6
IDS Protocols
5
1
Detects the presence of HijackLoader/IDAT Loader payloads disguised as non-PNG files. The rule identifies files containing concatenated PNG IDAT chunks that do not start with a valid PNG magic header, followed by a canonical IEND terminator, characteristic of steganographic data storage used to deploy the HijackLoader toolkit.
Detects the download of potential second-stage malicious payloads disguised as JPEG files to the C:\Windows\ directory using the URLDownloadToFile method. This activity is associated with Operation DragonReturn, where attackers save payloads as background.jpg for later decryption and execution.
Detects disguised malicious files, typically mimicking XML or MAP documents, that contain multiple PNG IDAT chunk markers but lack a valid PNG header and XML declaration. This signature is consistent with the HijackLoader staging technique, where XOR-encrypted and LZNT1-compressed data is hidden within the structure of spoofed file formats.
Detects DLL side-loading activities where the legitimate Radmin VPN executable loads an unsigned or malicious Qt5Core.dll from its local directory, or creates anomalous XML files that function as PNG-IDAT steganography containers. This behavior is associated with HijackLoader (IDAT Loader) malware infection chains.
Detects the download of potential steganographic image files (specifically .jpg extensions) from known malicious IP addresses, followed by the creation of a non-Microsoft-signed image file in the C:\Windows directory by the same process storyline. This behavior suggests the download and extraction of an embedded malicious payload.
Detects Microsoft Edge or Google Chrome spawning suspicious shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe), which is characteristic of the StegoAd browser extension campaign. The rule specifically flags browser processes launching script interpreters with command-line arguments containing obfuscated content (e.g., base64, eval) or references to specific image files (e.g., loading.webp, .woff2) used for steganographic payload delivery.
This rule detects screen capture activities associated with DcRAT, Millenium RAT, and Operation DragonReturn. It identifies the creation of specific staging files (e.g., debug.txt, background.jpg) at sensitive paths and monitors for non-standard or masquerading processes (such as svchost.exe running outside System32) that create image files in user-writable or temporary directories. The rule uses tiered logic, assigning a higher risk score to known IOC patterns and periodic capture behavior.
Detects instances where an unusual process (not a standard image viewer or web browser) reads a .png file and subsequently triggers a new process within a 5-minute window. This behavior is indicative of potential steganographic exploitation or hiding malicious code within image files, where a hidden payload is read and then executed.
Detects the creation of image-related files with generic names in common temporary or user download directories that fall within a specific file size range (100KB-1000KB). These characteristics are often indicative of steganography where malicious payloads or data are embedded within seemingly benign image files to bypass security controls.
Detects PNG image files that contain an embedded ZIP archive appended after the IEND chunk. This technique is commonly associated with Ousaban malware, which uses steganography to conceal malicious payloads (such as an executable named 'SysMain.exe') within image files to evade detection during delivery.
Detects the creation of image-related files with generic names in common temporary or user download directories that fall within a specific file size range (100KB-1000KB). These characteristics are often indicative of steganography where malicious payloads or data are embedded within seemingly benign image files to bypass security controls.
Detects powershell.exe executing a hidden .ps1 script from AppData\Local\Temp using character-code string concatenation obfuscation ([char]N+[char]N) and ForEach-Object {[char]$_} patterns, consistent with the TuglaInsaatci/Remcos steganographic loader campaign dropping pmxhtzb4w2q.ps1 for persistence.
Detects PowerShell script used to extract hidden payloads from BMP image files via RGB pixel channel parsing, as observed in multi-stage Remcos RAT loader campaign. This technique is often used to conceal malicious code within seemingly innocuous image files.
Detects the TuglaInsaatci steganographic loader technique where a randomly-named executable is dropped directly into the user's AppData\Roaming directory and subsequently launched within a short timeframe. This behavior is indicative of a self-copying persistence mechanism frequently used in campaigns like FortiBleed.
Detects potential DcRAT staging activity identified in Operation DragonReturn. The rule monitors for the creation of JPEG files in suspicious locations by non-browser processes (Sysmon EID 11), and the loading of .NET DLLs or files from staging directories by LOLBins such as mshta.exe, regsvr32.exe, or rundll32.exe (Sysmon EID 7).
Detects indicators of the DragonReturn malware campaign, specifically the download and deployment of malicious payloads hidden within image files. The rule monitors for network connections to known malicious infrastructure, the creation of specific steganographic staging files in sensitive directories, and the use of the URLDownloadToFile API to retrieve these payloads.
EchoCreep Decodes AES-CBC Base64 Command
Cortex XDR
Detects a non-browser process combining base64 decoding with AES-CBC processing before launching shell commands. This behavior is indicative of the EchoCreep malware, which uses sophisticated obfuscation techniques to hide its command and control communications.
Detects PNG or BMP image files used as steganographic carriers for hidden PE payloads. This rule specifically looks for PE (Portable Executable) headers (MZ and PE signatures) either appended after the PNG IEND (End of Image) marker or embedded within a high-entropy BMP file, indicating a hidden executable payload. This technique has been observed in multi-stage Remcos RAT loader campaigns.
This rule detects suspicious process command lines that indicate the extraction of steganographically hidden payloads, potentially associated with the Remcos RAT. It specifically looks for processes with 'GST' in their name or initiating process file name, combined with keywords related to bitmap or image resource manipulation in the command line.
Detects the steganographic payload extraction chain associated with the TuglaInsaatci .NET loader. The rule monitors for the sequential creation of 'payload.bin' (reconstructed from bitmap data) followed by the creation of 'Optimax.dll' on the same host, which is characteristic of the FortiBleed campaign's loader-as-a-service delivery methodology.
Detects potential use of steganography to hide C2 commands in image files
Page 2 of 4