Steganography Hide Zip Information in Picture File

Title: Steganography Hide Zip Information in Picture File
Status: test
Description:Detects appending of zip file to image
References:
  -https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/
Author: Pawel Mazur
Date: 2021-09-09
modified:2022-10-09
Tags:

• -'attack.stealth'
• -'attack.t1027.003'

Logsource:

• product: linux
• service: auditd

Detection:
  commands:
    type: 'EXECVE'
    a0: 'cat'
  a1:
    a1|endswith:
      -'.jpg'
      -'.png'

  a2:
    a2|endswith: '.zip'
  condition:commands and a1 and a2
Falsepositives:
  -Unknown
Level: low