Steganography Hide Files with Steghide

Title: Steganography Hide Files with Steghide
Status: test
Description:Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.
References:
  -https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/
Author: Pawel Mazur
Date: 2021-09-11
modified:2022-10-09
Tags:

• -'attack.stealth'
• -'attack.t1027.003'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'EXECVE'
    a0: 'steghide'
    a1: 'embed'
    a2:
      -'-cf'
      -'-ef'

    a4:
      -'-cf'
      -'-ef'

  condition:selection
Falsepositives:
  -Unknown
Level: low