Steganography Unzip Hidden Information From Picture File

Title: Steganography Unzip Hidden Information From Picture File
Status: test
Description:Detects extracting of zip file from image file
References:
  -https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/
Author: Pawel Mazur
Date: 2021-09-09
modified:2022-10-09
Tags:

• -'attack.stealth'
• -'attack.t1027.003'

Logsource:

• product: linux
• service: auditd

Detection:
  commands:
    type: 'EXECVE'
    a0: 'unzip'
  a1:
    a1|endswith:
      -'.jpg'
      -'.png'

  condition:commands and a1
Falsepositives:
  -Unknown
Level: low