HSI JPEG graphics file

Hunt Hypothesis

This rule identifies the presence of HSI JPEG graphics files, which may indicate an adversary using steganography or specific image formats to hide payloads or exfiltrate data within seemingly benign visual assets. Proactively hunting for these files in Azure Sentinel allows the SOC to uncover hidden data channels or embedded malware that standard file type scans might miss, reducing the risk of undetected lateral movement or data exfiltration.

YARA Rule

rule HSI_JPEG_graphics_file: PEiD
{
    strings:
        $a = { 68 73 69 31 00 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator uses IrfanView or XnView to batch-convert legacy JPEG images to PNG for a corporate intranet update, triggering the rule on the resulting .jpg files in the C:\Users\Public\Downloads or C:\Temp directories.

  • Filter/Exclusion: Exclude files with the .jpg or .jpeg extension located in standard user download, temp, or public folders (e.g., C:\Users\*\Downloads, C:\Temp, C:\Users\Public) if the parent process is a known image viewer or converter (e.g., IrfanView.exe, XnView.exe, Paint.NET.exe).

• Scenario: A scheduled task runs Adobe Photoshop or GIMP to automatically watermark and save JPEG screenshots from a CI/CD pipeline’s visual regression testing suite into a shared network drive.

  • Filter/Exclusion: Exclude JPEG files created by processes associated with image editing software (e.g., Photoshop.exe, gimp-2.10.exe) when the file path contains keywords like screenshots, regression, or assets within the application’s data directory or a mapped network share.

• Scenario: A developer uses Git to commit a new version of a logo or documentation image stored as a JPEG in the repository’s docs/images folder, causing the file to be written to the local working directory.

  • Filter/Exclusion: Exclude JPEG files located within directories named images, assets, static, or public that are part of a Git repository (identified by the presence of a .git folder in the parent directory tree) and are modified by git.exe or code.exe (VS Code).

• Scenario: A marketing team