TerminalFix Campaign: Detecting PNG Steganography Payloads and Reverse Tunnels in a Multistage Intrusion

---
title: PowerShell Image Download and Pixel Extraction - Possible Steganographic Loader
id: 8b3d2f41-6a1e-4c92-b7d4-5f8a9c2e1d07
status: experimental
description: Detects PowerShell downloading image files and/or using System.Drawing pixel enumeration consistent with LSB steganographic payload extraction, as seen in the TerminalFix campaign.
references:
  - https://isc.sans.edu/diary/rss/33318
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1140/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_img_download:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '.png'
  selection_download_verbs:
    CommandLine|contains:
      - 'DownloadFile'
      - 'DownloadString'
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'curl '
      - 'Start-BitsTransfer'
  selection_decode:
    CommandLine|contains:
      - 'System.Drawing'
      - 'GetPixel'
      - 'FromBase64String'
      - 'BitConverter'
  condition: selection_img_download and (selection_download_verbs or selection_decode)
falsepositives:
  - Legitimate wallpaper/theme automation scripts (rare in enterprise server environments)
  - Image processing build pipelines
level: high
---
title: Reverse Tunneling Tool Execution - ngrok Cloudflared SSH Reverse Forward
id: 2f7a9c14-8d3b-4e61-a9c2-6b4d8e1f3a05
status: experimental
description: Detects execution of known reverse tunneling utilities or SSH with reverse-forward flags, the final-stage C2 mechanism observed in the TerminalFix campaign.
references:
  - https://isc.sans.edu/diary/rss/33318
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1572
  - attack.t1090
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith:
      - '\ngrok.exe'
      - '\cloudflared.exe'
      - '\bore.exe'
      - '\chisel.exe'
      - '\frpc.exe'
      - '\zrok.exe'
      - '\localhost.run'
  selection_ssh_reverse:
    Image|endswith:
      - '\ssh.exe'
    CommandLine|contains:
      - ' -R '
      - ' -R:'
  selection_tunnel_args:
    CommandLine|contains:
      - 'tunnel --url'
      - 'tcp --region'
      - 'http --domain'
      - 'authtoken'
  condition: selection_binary or selection_ssh_reverse or selection_tunnel_args
falsepositives:
  - Developers legitimately using ngrok/cloudflared for testing - baseline and whitelist known users
  - IT admin SSH reverse forwarding for remote support
level: high
---
title: Script Interpreter Spawning Tunneling or Shell Binary from User-Writable Path
id: 5c1e8a36-4f92-4b7d-9a31-7e2c5d8f6b09
status: experimental
description: Detects PowerShell or script hosts spawning executables from temp/AppData paths, consistent with an in-memory decoded payload chain dropping a tunneling stage.
references:
  - https://isc.sans.edu/diary/rss/33318
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_child_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  filter_known:
    Image|endswith:
      - '\teams.exe'
      - '\onedrive.exe'
      - '\slack.exe'
  condition: selection_parent and selection_child_path and not filter_known
falsepositives:
  - SaaS updaters (Teams, OneDrive) - extend filter for your environment
level: medium

// Hunt 1: PowerShell downloading or decoding PNG/image files (steganographic loader behavior)
let ImageLoader = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (".png", ".jpg", ".bmp")
  and ProcessCommandLine has_any ("DownloadFile", "DownloadString", "Invoke-WebRequest", "iwr", "Start-BitsTransfer", "GetPixel", "System.Drawing", "FromBase64String")
| project LoaderTime=TimeGenerated, DeviceName, DeviceId, AccountName, LoaderCmd=ProcessCommandLine;
// Hunt 2: Tunneling tools or reverse SSH on the same estate
let TunnelActivity = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("ngrok.exe", "cloudflared.exe", "chisel.exe", "frpc.exe", "bore.exe")
   or (FileName =~ "ssh.exe" and ProcessCommandLine has " -R")
   or ProcessCommandLine has_any ("tunnel --url", "authtoken", "tcp --region")
| project TunnelTime=TimeGenerated, DeviceName, DeviceId, AccountName, TunnelCmd=ProcessCommandLine, TunnelBin=FileName;
// Correlate: loader and tunnel on the same device = TerminalFix-style chain
ImageLoader
| join kind=inner TunnelActivity on DeviceName
| where abs(datetime_diff('minute', TunnelTime, LoaderTime)) <= 60
| project DeviceName, AccountName, LoaderTime, LoaderCmd, TunnelTime, TunnelBin, TunnelCmd
| sort by LoaderTime desc

// Hunt 3 (Syslog/CEF ingestion for Linux or network devices): outbound long-lived connections to tunnel service domains
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationHostName has_any ("ngrok.io", "ngrok-free.app", "trycloudflare.com", "bore.pub", "localhost.run", "serveo.net", "zrok.io")
| project TimeGenerated, SourceIP, DestinationHostName, DestinationPort, DeviceAction, RequestURL
| sort by TimeGenerated desc

-- TerminalFix hunt: steganographic loader processes + tunneling binaries/connections
LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)\.png|\.jpg|GetPixel|System\.Drawing'
   OR Exe =~ '(?i)(ngrok|cloudflared|chisel|frpc|bore|zrok)\.exe$'
   OR (Name =~ '(?i)ssh\.exe' AND CommandLine =~ '(?i)\s-R[\s:]')

LET conns = SELECT Pid, Name, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status = 'ESTABLISHED'
  AND RemotePort in (443, 8443, 22, 3389, 8080)
  AND Name =~ '(?i)(ngrok|cloudflared|chisel|frpc|bore|ssh|powershell)'

SELECT * FROM procs
UNION ALL
SELECT Pid, NULL AS Ppid, Name, NULL AS Exe,
       format(format='ESTABLISHED to %v:%v', args=[RemoteAddr, RemotePort]) AS CommandLine,
       NULL AS Username, NULL AS CreateTime
FROM conns

-- Persistence check: scheduled tasks and run keys referencing tunneling tools or temp paths
SELECT Name, Command, FullName as KeyPath, ModTime
FROM glob(globs='C:/Windows/System32/Tasks/*', accessor='ntfs')
WHERE read_file(accessor='ntfs', filenames=FullName) =~ '(?i)(ngrok|cloudflared|AppData\\Local\\Temp|powershell.*\.png)'

# TerminalFix triage & remediation - run as Administrator
$Report = @()

# 1) Find running tunneling tools and reverse-SSH sessions
$tunnelProcs = Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match '^(ngrok|cloudflared|chisel|frpc|bore|zrok)' -or
    ($_.Name -match '^ssh' -and $_.CommandLine -match '-R')
}
foreach ($p in $tunnelProcs) {
    $Report += [pscustomobject]@{Type='TunnelProcess'; Name=$p.Name; PID=$p.ProcessId; Cmd=$p.CommandLine; Path=$p.ExecutablePath}
    Stop-Process -Id $p.ProcessId -Force -ErrorAction SilentlyContinue
}

# 2) Flag PowerShell processes referencing image files or pixel-decoding (possible stego loaders)
$stego = Get-CimInstance Win32_Process | Where-Object {
    $_.Name -match '^powershell|^pwsh' -and
    $_.CommandLine -match '\.png|\.jpg|GetPixel|System\.Drawing'
}
foreach ($p in $stego) {
    $Report += [pscustomobject]@{Type='StegoLoader'; Name=$p.Name; PID=$p.ProcessId; Cmd=$p.CommandLine; Path=$p.ExecutablePath}
}

# 3) Quarantine suspicious recently-downloaded images in user-writable dirs (last 14 days)
$paths = @("$env:TEMP","$env:USERPROFILE\Downloads","$env:USERPROFILE\AppData\Local\Temp","C:\Users\Public")
$suspectPngs = Get-ChildItem $paths -Recurse -Include *.png,*.jpg -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and $_.Length -gt 200KB }
$quarantine = "C:\Quarantine_$((Get-Date).ToString('yyyyMMdd_HHmmss'))"
if ($suspectPngs) {
    New-Item -ItemType Directory -Path $quarantine -Force | Out-Null
    foreach ($f in $suspectPngs) {
        $Report += [pscustomobject]@{Type='SuspectImage'; Name=$f.Name; PID=''; Cmd=$f.FullName; Path="$($f.Length) bytes, $($f.LastWriteTime)"}
        Move-Item $f.FullName $quarantine -Force -ErrorAction SilentlyContinue
    }
}

# 4) Pull established outbound sessions for tunnel-capable processes
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 22,443,8443,8080 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc.Name -match 'ngrok|cloudflared|chisel|frpc|bore|ssh|powershell') {
            $Report += [pscustomobject]@{Type='OutboundSession'; Name=$proc.Name; PID=$_.OwningProcess; Cmd="$($_.RemoteAddress):$($_.RemotePort)"; Path='ESTABLISHED'}
        }
    }

# 5) Audit persistence: scheduled tasks & run keys referencing tunneling tools or temp paths
$tasks = Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'ngrok|cloudflared|AppData\\Local\\Temp' -or
    ($_.Actions.Arguments -match '\.png|-R ')
}
foreach ($t in $tasks) { $Report += [pscustomobject]@{Type='Persistence-Task'; Name=$t.TaskName; PID=''; Cmd=$t.Actions.Execute; Path=$t.TaskPath} }

$Report | Format-Table -AutoSize
$Report | Export-Csv ".\TerminalFix_Triage_$env:COMPUTERNAME.csv" -NoTypeInformation
Write-Host "`nTriage complete. Review CSV output; preserve memory/image before wiping suspect hosts." -ForegroundColor Yellow