AN0331
Analytic 0331
Windows
Detects execution of image viewers or PowerShell scripts accessing or decoding files with mismatched MIME headers or embedded script-like byte patterns; often correlated with suspicious parent-child process lineage and outbound connections.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Security
EventCode=4663, 4670, 4656
[ParentProcessImage]
Tune to identify image editors/viewers invoking script interpreters (e.g., `mspaint.exe` > `powershell.exe`)
[MimeHeaderMismatchTolerance]
Adjust tolerance for image file headers that do not match file extensions or content structure
[TimeWindow]
Define the temporal range to correlate decoding → execution → network beaconing
AN0332
Analytic 0332
Linux
Detects access to media files followed by execution of scripts (bash, Python, etc.) referencing those same files, or outbound traffic triggered shortly after file read. Correlates unusual use of tools like `steghide`, `exiftool`, or image libraries.
auditd:SYSCALL
open
auditd:SYSCALL
execve
auditd:SYSCALL
connect
[MonitoredToolsList]
Define the list of steganographic or image-parsing tools to alert on (e.g., `steghide`, `imagemagick`)
[ScriptInterpreterMatch]
Tune to detect script engines accessing media files (e.g., `python script.py image.png`)
AN0333
Analytic 0333
macOS
Detects manipulation of PNG, JPG, or GIF files by user-initiated scripts followed by script execution or exfiltration behavior, especially from `osascript`, `python`, or `bash`, in combination with LaunchAgent persistence or curl activity.
macos:osquery
file_events
macos:osquery
process_events
macos:unifiedlog
network connection events
[StegoToolNamePatterns]
Adapt to known or emerging tools using stego methods on macOS (e.g., `Invoke-PSImage`, `stegsolve`)
[ParentScriptSources]
Update list of trusted versus unknown scripting hosts launching activity tied to image handling