defection.io

tool

Invoke-PSImage S0231

Type: tool
Created: 18 April 2018
Last modified: 16 April 2025

Invoke-PSImage takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords. [1]

TechniquesBottom 7%

TacticBottom 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

tool

Invoke-PSImage S0231

Type: tool
Created: 18 April 2018
Last modified: 16 April 2025

TechniquesBottom 7%

TacticBottom 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Invoke-PSImage MITRE reference S0231

Steganography T1027.003 ↗

Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.2

Stealth5 detection rules

Embedded Payloads T1027.009 ↗

Invoke-PSImage can be used to embed payload data within a new image file.3

Stealth2 detection rules

Standing S0231

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques2Bottom 7%

7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique3.5medBottom 3%

3rd percentile · 97% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique0med

Invoke-PSImage detections S0231

7 distinct rules cover the 2 techniques recorded for this tool. 7 Sigma.

2 covered by at least one rule7 distinct rules in total

Showing 1-7 of 7 rules

Drag headers to reorder | Drag edges to resize

Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indirect Command Execution Stealth Masquerading Stealth Obfuscated Files or Information Steganography	-	medium	Trent Liffick	2020-05-01	2024-01-15	33339be3-148b-4e16-af56-ad16ec6c7e7b
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation in Powershell scripts. (...)	Hunting	test	ps_script	windows	PowerShell	Stealth Obfuscated Files or Information Embedded Payloads	-	medium	frack113	2022-12-27	2025-10-19	f3a98ce4-6164-4dd4-867c-4d83de7eca51
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information Embedded Payloads	-	high	frack113	2022-12-27	2026-03-16	deb9b646-a508-44ee-b7c9-d8965921c6b6
Detects extraction of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.	Generic	test	process_creation	linux	Linux Auditd	Stealth Obfuscated Files or Information Steganography	-	low	Pawel Mazur	2021-09-11	2022-10-09	a5a827d9-1bbe-4952-9293-c59d897eb41b
Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information.	Generic	test	process_creation	linux	Linux Auditd	Stealth Obfuscated Files or Information Steganography	-	low	Pawel Mazur	2021-09-11	2022-10-09	ce446a9e-30b9-4483-8e38-d2c9ad0a2280
Detects appending of zip file to image	Generic	test	process_creation	linux	Linux Auditd	Stealth Obfuscated Files or Information Steganography	-	low	Pawel Mazur	2021-09-09	2022-10-09	45810b50-7edc-42ca-813b-bdac02fb946b
Detects extracting of zip file from image file	Generic	test	process_creation	linux	Linux Auditd	Stealth Obfuscated Files or Information Steganography	-	low	Pawel Mazur	2021-09-09	2022-10-09	edd595d7-7895-4fa7-acb3-85a18a8772ca