Abnormally Large JPEG Filed Downloaded from New Source

Hunt Hypothesis

Threat actors may be using abnormally large JPEG files to exfiltrate data or hide malicious payloads, leveraging the file type to bypass security inspections. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential data exfiltration or malware delivery attempts that evade traditional detection methods.

KQL Query

let percentile = 95;
  let lookback_data = materialize(CommonSecurityLog
  | where TimeGenerated between(ago(7d)..ago(1d))
  | where FileType == "Jpeg Files" or RequestURL endswith ".jpg"
  | where isnotempty(RequestURL));
  let domains = lookback_data | summarize by DestinationHostName;
  CommonSecurityLog
  | where TimeGenerated > ago(1d)
  | where FileType =~ "Jpeg Files" or RequestURL endswith ".jpg"
  | where isnotempty(RequestURL)
  | extend filename = split(RequestURL, "/")[-1]
  | where ReceivedBytes > toscalar(lookback_data
  | summarize percentile(ReceivedBytes, percentile))
  | project-reorder TimeGenerated, filename, RequestURL, ReceivedBytes, RequestClientApplication, SourceUserName, DestinationHostName, RequestContext 
  | where DestinationHostName !in (domains) or isempty(DestinationHostName)

Analytic Rule Definition

id: a2ff777e-46c8-4649-b19a-25a0ac059a18
name: Abnormally Large JPEG Filed Downloaded from New Source
description: |
  'Threat actors can use JPEG files to hide malware, or other malicious code from inspection. This query looks for the downloading of abnormally large JPEG files from a source where large JPEG files have not been downloaded.
    Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
requiredDataConnectors:
  - connectorId: CEF
    dataTypes:
      - CommonSecurityLog
tactics:
  - InitialAccess
relevantTechniques:
  - T1001.002
query: |
  let percentile = 95;
    let lookback_data = materialize(CommonSecurityLog
    | where TimeGenerated between(ago(7d)..ago(1d))
    | where FileType == "Jpeg Files" or RequestURL endswith ".jpg"
    | where isnotempty(RequestURL));
    let domains = lookback_data | summarize by DestinationHostName;
    CommonSecurityLog
    | where TimeGenerated > ago(1d)
    | where FileType =~ "Jpeg Files" or RequestURL endswith ".jpg"
    | where isnotempty(RequestURL)
    | extend filename = split(RequestURL, "/")[-1]
    | where ReceivedBytes > toscalar(lookback_data
    | summarize percentile(ReceivedBytes, percentile))
    | project-reorder TimeGenerated, filename, RequestURL, ReceivedBytes, RequestClientApplication, SourceUserName, DestinationHostName, RequestContext 
    | where DestinationHostName !in (domains) or isempty(DestinationHostName)
entityMappings:
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: filename
  - entityType: Url
    fieldMappings:
      - identifier: Url
        columnName: RequestURL
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: SourceUserName

Required Data Sources

MITRE ATT&CK Context

• Tactic: InitialAccess
• Technique: T1001.002 — T1001.002

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/CommonSecurityLog/AbnormallyLargeJPEGFiledDownloadedfromNewSource.yaml)

False Positive Guidance

• Scenario: Scheduled Backup Job Exporting Large JPEGs
  Description: A backup tool (e.g., Veeam, Acronis) exports large JPEG files as part of a scheduled job for archival purposes.
  Filter/Exclusion: process.parent_process_name:"Veeam Backup & Replication" or process.parent_process_name:"Acronis True Image"

• Scenario: User-Initiated Large Image Transfer for Graphic Design
  Description: A graphic designer (using Adobe Photoshop or GIMP) exports a large JPEG file to a cloud storage service (e.g., Google Drive, Dropbox) for client delivery.
  Filter/Exclusion: process.name:"Photoshop.exe" or process.name:"gimp.exe" and destination:"google.com" or "dropbox.com"

• Scenario: System Log File Converted to JPEG for Documentation
  Description: An admin tool (e.g., Splunk, ELK Stack) generates a report in JPEG format for documentation or presentation.
  Filter/Exclusion: process.name:"splunkd.exe" or process.name:"elasticsearch.exe" and file_name:"report.jpg"

• Scenario: Automated Report Generation with Embedded Images
  Description: A reporting tool (e.g., Tableau, Power BI) generates a report with embedded large JPEG images for internal use.
  Filter/Exclusion: process.name:"Tableau.exe" or process.name:"Power BI.exe" and file_extension:"jpg"

• Scenario: Admin Task to Archive Historical JPEG Files
  Description: An admin runs a script (e.g., PowerShell, Bash) to archive old JPEG files from a shared folder to a NAS or cloud storage.
  Filter/Exclusion: process.name:"powershell.exe" or process.name:"bash" and `source:“\server\