The SANS Internet Storm Center diary entry on DOUBLECUP calls out an important defensive nuance: the malware is being discussed as steganography, but the technique described is not real steganography. That distinction matters. If your detections are tuned for pixel-level least-significant-bit payloads, you will miss a loader that simply stores, appends, encodes, or chunks malicious content inside a PNG container and later pulls it back out with a script or LOLBin.
No CVE identifier is provided in the source item, and this should be treated as an active malware tradecraft problem rather than a patchable product flaw. The risk is highest for Windows endpoints that receive PNGs through email, web downloads, chat, or compromised sites and then run extraction logic through PowerShell, cmd, mshta, rundll32, certutil, wscript, or a first-stage loader.
What Is At Risk
The defensive issue is not a glamorous image-forensics problem. It is a container-abuse problem. A PNG can remain a syntactically valid image while still carrying attacker-controlled data in places many controls do not inspect deeply: after the IEND chunk, inside ancillary chunks, inside compressed data, or inside content that is merely Base64 encoded and not hidden in pixels at all.
That creates a practical exposure pattern:
- Email and web gateways detonate or inspect the visible image, not the bytes after IEND.
- EDR sees powershell.exe or rundll32.exe but the command line only references a harmless-looking .png.
- Proxy logs show an image MIME type while the downloaded object contains executable markers or encoded script text.
- Threat intel labels the technique steganography, sending hunters toward LSB tooling while the actor is using simpler embedding and extraction.
Treat DOUBLECUP-style PNG handling as ingress tool transfer plus obfuscation, mapped to MITRE ATT&CK T1105, T1027, T1140, and T1027.003 where true steganography is claimed but not proven.
Technical Analysis
Affected products and platforms
The source item does not name an affected vendor, version, or CVE. The affected surface is operational: Windows workstations and servers that can download PNG objects and execute local extraction logic. The highest-risk process chain is browser, email client, Office application, or archiver followed by a script interpreter or signed Microsoft binary.
How the attack works, from a defender's perspective
A realistic DOUBLECUP-style chain looks like this:
- A PNG is delivered through web, email, or a staging URL.
- The file has a valid PNG signature and enough valid chunks to render or pass shallow inspection.
- The payload is not meaningfully hidden in pixel values. It is appended after IEND, placed in an ancillary chunk, stored in compressed data, or encoded as text that only looks image-adjacent.
- A loader or command line reads the .png, decodes or carves bytes, and executes the result.
- Defenders see an image file and a separate process execution, but not the relationship between them.
The disappointing part, as the SANS author notes, is that fake steganography is often easier to detect than real steganography. Trailing bytes after IEND, impossible chunk lengths, executable strings in an image, Base64 markers in a binary container, and process command lines touching .png files are all observable if telemetry is correlated.
Exploitation status
This is current malware tradecraft discussed in a current SANS ISC diary. There is no CVE, no CVSS score, and no CISA KEV entry in the source item. Do not wait for a KEV listing. Hunt the behavior now, especially where PNG downloads are common and script interpreters are allowed to run from user contexts.
Detection and Response
---
title: Script or LOLBin References PNG Payload Extraction
id: 3e9b6f10-7c2a-4d61-9f0a-7c7c5d2aa111
status: experimental
description: Detects script interpreters or signed Windows binaries referencing PNG files together with decoding, execution, or payload-building terms consistent with DOUBLECUP-style image-container abuse.
references:
- https://isc.sans.edu/diary/rss/33274
- https://attack.mitre.org/techniques/T1140/
- https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/08/24
tags:
- attack.execution
- attack.defense_evasion
- attack.t1140
- attack.t1027
logsource:
category: process_creation
product: windows
detection:
selection_png:
CommandLine|contains: '.png'
selection_bin:
Image|contains:
- 'powershell'
- 'pwsh'
- 'cmd'
- 'mshta'
- 'rundll32'
- 'regsvr32'
- 'certutil'
- 'wscript'
- 'cscript'
selection_terms:
CommandLine|contains:
- 'FromBase64String'
- 'base64'
- 'decode'
- 'IEX'
- 'Invoke-Expression'
- 'Add-Type'
- 'certutil'
- 'mshta'
- 'rundll32'
- 'IEND'
- 'tEXt'
- 'zTXt'
condition: selection_png and selection_bin and selection_terms
falsepositives:
- Legitimate image conversion or automation pipelines that decode PNG metadata
- Software deployment tools that stage encoded resources temporarily
level: high
---
title: PNG Written by Mail Browser or Office Process in User Writable Path
id: 8d4c5f61-2a19-4c8e-b731-0f45d0a7e222
status: experimental
description: Detects creation of PNG files in Downloads, Temp, AppData, or user profile paths by email clients, browsers, Office, or archive tools. Correlated with process execution, this identifies delivery of image-carried payloads.
references:
- https://isc.sans.edu/diary/rss/33274
- https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/08/24
tags:
- attack.initial_access
- attack.command_and_control
- attack.t1105
logsource:
category: file_event
product: windows
detection:
selection_src:
Image|contains:
- 'outlook'
- 'thunderbird'
- 'chrome'
- 'msedge'
- 'firefox'
- 'winword'
- 'excel'
- 'powerpnt'
- '7z'
- 'winrar'
selection_path:
TargetFilename|contains:
- 'Downloads'
- 'Temp'
- 'AppData'
- 'Users'
- 'ProgramData'
selection_ext:
TargetFilename|endswith: '.png'
condition: selection_src and selection_path and selection_ext
falsepositives:
- Normal downloads, screenshots, and email attachments
- Line-of-business apps that export image reports
level: medium
let Lookback = 14d;
let PngWrites = DeviceFileEvents
| where TimeGenerated >= ago(Lookback)
| where FolderPath endswith '.png'
| where FolderPath has_any ('Downloads','Temp','AppData','Users','ProgramData')
| where InitiatingProcessFileName in~ ('outlook.exe','thunderbird.exe','chrome.exe','msedge.exe','firefox.exe','winword.exe','excel.exe','powerpnt.exe','7z.exe','winrar.exe')
| project PngTime=TimeGenerated, DeviceId, DeviceName, PngPath=FolderPath, PngName=FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
PngWrites
| join kind=inner (
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName in~ ('powershell.exe','pwsh.exe','cmd.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe','wscript.exe','cscript.exe')
| where ProcessCommandLine has_any ('.png','FromBase64String','base64','IEX','Invoke-Expression','certutil','decode','Add-Type','IEND','zTXt','tEXt')
| project ProcTime=TimeGenerated, DeviceId, ProcessFileName=FileName, ProcessCommandLine, ProcessId, InitiatingProcessFileName
) on DeviceId
| where ProcTime between (PngTime .. PngTime + 15m)
| summarize FirstSeen=min(ProcTime), LastSeen=max(ProcTime), Commands=make_set(ProcessCommandLine), Processes=make_set(ProcessFileName) by DeviceName, PngPath, PngName, SHA256, InitiatingProcessFileName
| order by LastSeen desc;
-- DOUBLECUP-style PNG extraction: suspicious processes plus their outbound sockets
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)\.png|FromBase64String|certutil|Invoke-Expression|IEX|Add-Type|IEND|zTXt|tEXt'
OR Name =~ '(?i)powershell|pwsh|mshta|rundll32|regsvr32|wscript|cscript'
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
netstat().LocalIP AS LocalIP,
netstat().LocalPort AS LocalPort,
netstat().RemoteIP AS RemoteIP,
netstat().RemotePort AS RemotePort,
netstat().Status AS SocketStatus
FROM procs
ORDER BY CreateTime DESC
Immediate Hunting Checklist
Start with joins, not single events. A PNG in Downloads is noise. A PNG in Downloads followed within minutes by PowerShell, certutil, mshta, rundll32, or a child process is signal.
Prioritize these evidence pairs:
- DeviceFileEvents for .png plus DeviceProcessEvents within 5 to 15 minutes.
- Proxy or secure web gateway logs where Content-Type is image/png but the response body contains MZ, This program cannot be run in DOS mode, FromBase64String, long Base64 runs, IEND followed by large trailing data, or script keywords.
- Email gateway attachment records where .png attachments are followed by endpoint process execution in the same recipient session window.
- EDR module load and script block telemetry for image paths passed into Add-Type, Reflection.Assembly.Load, or Invoke-Expression.
- File integrity checks on PNGs: valid 8-byte signature, expected chunk sequence, CRC sanity, IEND placement, and count of bytes after IEND.
Containment should be fast and boring: isolate the host, preserve the PNG and any process dumps, capture command lines and parent-child trees, block the staging URL or sender, then search the estate for the same SHA256, file name, URL, command-line fragment, and PNG structure anomaly.
Remediation and Hardening
There is no vendor patch version to apply because the source does not describe a product vulnerability. Remediate by reducing execution opportunity and increasing image-container visibility.
- Block or script-control extraction pathways. Constrain PowerShell, mshta, wscript, cscript, rundll32, regsvr32, and certutil for standard users through WDAC or AppLocker. Require signed scripts where operationally feasible.
- Turn on telemetry before you need it. Enable process creation with command line, PowerShell Script Block Logging and Module Logging, Microsoft Defender for Endpoint file and process events, and DNS or proxy logging for image downloads.
- Inspect PNG structure at the gateway and in DFIR. Flag files with data after IEND, invalid chunk ordering, oversized ancillary chunks, executable headers, or long high-entropy or Base64-like regions.
- Strip or rewrite risky attachments. For mail, convert inbound PNGs to clean re-encoded images for high-risk users, or quarantine PNGs that contain non-image strings or trailing data.
- Reduce user-context execution. Remove local admin where possible, enforce SmartScreen and attack surface reduction rules, and prevent Office or mail clients from launching script interpreters without an allow reason.
- Add detections for fake steganography explicitly. Do not assume stego tooling equals coverage. Create analytics for appended bytes, invalid chunks, MIME mismatch, and process command lines touching image files.
param(
[string]$Path = $env:TEMP,
[string]$OutCsv = 'doublecup_png_audit.csv',
[switch]$EnableLogging
)
if ($EnableLogging) {
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Run as Administrator when using -EnableLogging' }
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -Value 1 -Type DWord
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging' -Name EnableModuleLogging -Value 1 -Type DWord
New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Force | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -Value 1 -Type DWord
Write-Output 'Enabled script block, module, and process command-line logging policies. Confirm with gpresult and your SIEM ingestion.'
}
$pngSig = [byte[]](0x89,0x50,0x4E,0x47,0x0D,0x0A,0x1A,0x0A)
$iend = [byte[]](0x00,0x00,0x00,0x00,0x49,0x45,0x4E,0x44,0xAE,0x42,0x60,0x82)
$needles = @('MZ','This program cannot be run in DOS mode','FromBase64String','Invoke-Expression','Add-Type','certutil','mshta','rundll32','powershell','http://','https://')
function Find-Bytes([byte[]]$Hay,[byte[]]$Needle) {
for ($i=0; $i -le $Hay.Length - $Needle.Length; $i++) {
$ok = $true
for ($j=0; $j -lt $Needle.Length; $j++) { if ($Hay[$i+$j] -ne $Needle[$j]) { $ok=$false; break } }
if ($ok) { return $i }
}
return -1
}
Get-ChildItem -Path $Path -Recurse -Filter *.png -ErrorAction SilentlyContinue | ForEach-Object {
try {
$bytes = [System.IO.File]::ReadAllBytes($_.FullName)
$sigAt = Find-Bytes $bytes $pngSig
$iendAt = Find-Bytes $bytes $iend
$text = [System.Text.Encoding]::ASCII.GetString($bytes)
$hits = @()
foreach ($n in $needles) { if ($text.IndexOf($n,[StringComparison]::OrdinalIgnoreCase) -ge 0) { $hits += $n } }
[pscustomobject]@{
File = $_.FullName
Size = $_.Length
PngSignature = ($sigAt -eq 0)
IendOffset = $iendAt
TrailingBytesAfterIend = if ($iendAt -ge 0) { $bytes.Length - ($iendAt + 12) } else { -1 }
SuspiciousMarkers = ($hits -join '|')
LastWriteTime = $_.LastWriteTime
}
} catch {}
} | Where-Object { $_.TrailingBytesAfterIend -gt 0 -or $_.SuspiciousMarkers -ne '' -or -not $_.PngSignature } | Export-Csv -NoTypeInformation -Path $OutCsv
Write-Output ('Audit complete: ' + $OutCsv)
Executive Takeaways
- Do not chase the word steganography. Validate how bytes are actually stored and extracted.
- The strongest detection is correlation: image arrival plus short-window execution plus decode language.
- A valid PNG can still be hostile. Enforce IEND trailing-byte checks and MIME/body mismatch inspection.
- Remove easy extraction paths for users: unsigned PowerShell, mshta, certutil decode abuse, rundll32, and script hosts.
- Preserve the original object during response. Re-saving or previewing the image can destroy the forensic relationship between container and payload.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.