PowerShell walking image pixels on the command line

Siemphony@siemphonymediumT1027.003unverified

Matches a process creation where a PowerShell host is launched with both a media filename and a pixel-level extraction construct on the same command line, which is the observable half of AN0331 — the Invoke-PSImage shape, where a .png is opened not to display it but to reassemble script or shellcode out of its pixels. Neither term alone is worth alerting on, so both selections are required: a media extension without a pixel construct is ordinary image handling, and a decoder without a media file is generic base64 work that belongs to the obfuscation parent T1027. The construct list is deliberately narrow. `System.Drawing`, `Bitmap`, `ReadAllBytes` and `FromBase64String` were removed because branding, wallpaper, thumbnailing and installer scripts use them on media files constantly, and `certutil -decode` with them, because unwrapping a base64 asset is the parent technique rather than steganography. What is left is per-pixel access, which ordinary scripts have little reason to do. The blind spot is large and structural: Sysmon EventID 1 and Security 4688 record only what was typed on the invocation line, so the same decode logic run as `powershell -File decode.ps1 logo.png`, or wrapped in `-EncodedCommand`, puts none of these tokens on the command line and is invisible here even though PowerShell 4104 ScriptBlockText would show it in full — no PowerShell log source appears in this brief (AN0331 names Sysmon EventID 1, 3 and 22 and Security 4663/4670/4656 only), so that rebuild cannot be done without inventing a logsource. Treat this as a hunting lead for inline one-liners, not as coverage of the technique. Nothing here inspects the file either, so a genuine carrier image and a corporate logo are indistinguishable to it, and a compiled loader reading a PNG from its own resources puts nothing on a command line at all. Prerequisite: this is written in the Sysmon EventID 1 process-creation vocabulary (`Image`, `CommandLine`), and Sysmon is not present in a default Windows install; an estate with only Security 4688 needs the Image-to-NewProcessName mapping first, plus Audit Process Creation and the separate policy that includes the command line in those events. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0119, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains ".png" or ProcessCommandLine contains ".jpg" or ProcessCommandLine contains ".jpeg" or ProcessCommandLine contains ".bmp" or ProcessCommandLine contains ".gif" or ProcessCommandLine contains ".ico" or ProcessCommandLine contains ".wav")) and (ProcessCommandLine contains "GetPixel" or ProcessCommandLine contains "LockBits" or ProcessCommandLine contains "Invoke-PSImage"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*.png*" OR CommandLine="*.jpg*" OR CommandLine="*.jpeg*" OR CommandLine="*.bmp*" OR CommandLine="*.gif*" OR CommandLine="*.ico*" OR CommandLine="*.wav*")) AND (CommandLine="*GetPixel*" OR CommandLine="*LockBits*" OR CommandLine="*Invoke-PSImage*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*.png*" OR TO_LOWER(process.command_line) LIKE "*.jpg*" OR TO_LOWER(process.command_line) LIKE "*.jpeg*" OR TO_LOWER(process.command_line) LIKE "*.bmp*" OR TO_LOWER(process.command_line) LIKE "*.gif*" OR TO_LOWER(process.command_line) LIKE "*.ico*" OR TO_LOWER(process.command_line) LIKE "*.wav*")) AND (TO_LOWER(process.command_line) LIKE "*getpixel*" OR TO_LOWER(process.command_line) LIKE "*lockbits*" OR TO_LOWER(process.command_line) LIKE "*invoke-psimage*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(\.png|\.jpg|\.jpeg|\.bmp|\.gif|\.ico|\.wav)</field>    <field name="CommandLine" type="pcre2">(?i)(GetPixel|LockBits|Invoke-PSImage)</field>    <description>PowerShell walking image pixels on the command line</description>    <mitre>      <id>T1027.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: fed5e59a-008e-4c19-a4be-37c5480589e8

ATT&CKT1027.003

T1027.003Steganography

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloads

01 · What this rule detects

Content made deliberately unreadable before it runs — a base64 or hex blob passed on a command line, a script assembled from concatenated fragments, a packed or encrypted file on disk, and the decode step that has to happen before any of it executes. The obfuscation itself is not the finding; the transition from encoded to executed is. Guardrailed payloads belong here too, where the key is derived from the victim's domain or hostname so the content only decodes on the intended machine and never in your sandbox.

02 · Telemetry you need

Sysmon EventID 1 CommandLine, ParentImage and OriginalFileName, complete and untruncated — Security 4688 needs Audit Process Creation for the event and the separate 'Include command line in process creation events' policy for the arguments, and without the second one you get the image name and none of the encoding
PowerShell script block logging (EventID 4104), which records the content after decoding — off by default, and long blocks are split across several events with MessageNumber and MessageTotal, so a contains match on one event misses any string that straddles the split
Sysmon EventID 11 (FileCreate) for the decoded payload written to disk and EventID 7 (ImageLoad) for what is loaded straight afterwards — a reflectively loaded module produces no EventID 7 at all, so absence here proves nothing
auditd execve records on Linux — the rule must be loaded in /etc/audit/rules.d or nothing is captured, and any argument containing whitespace or non-printable characters is written hex-encoded rather than as text, so a match written against the plaintext string silently never fires
Antimalware Scan Interface telemetry where your endpoint product exposes it: it sees the buffer after decoding, but only for the runtimes that call it — PowerShell, the Windows Script Host, VBA and .NET — never a native loader

03 · How the logic works

Start with the trap, because it is the reason most rules in this category are unusable: base64 on a command line is overwhelmingly benign. Installers pass encoded configuration, telemetry agents pass encoded payloads, deployment tooling ships whole scripts as -EncodedCommand, and scheduled tasks are registered with base64 arguments by products nobody considers suspicious. 'Contains base64' and 'high entropy' are therefore not detections — entropy measures compressibility, not intent, and certificates, GUIDs, JWTs, minified JavaScript and packed commercial binaries all score exactly as high as a packed implant. Entropy is a ranking signal for triage, not a firing condition.

What makes it a detection is base64 plus a decode-and-execute pair in the same command line or the same script block: FromBase64String alongside Invoke-Expression, IEX or .Invoke(); certutil -decode followed by execution of what it wrote; base64 -d piped into sh or bash; eval over a decoded string. Match the pair, not the blob. One useful specific: -EncodedCommand payloads are UTF-16LE before encoding, so a decoded ASCII keyword appears as a predictable base64 fragment — but the fragment depends on the byte offset the string starts at, so you need all three alignments of each keyword or the match is a coin flip.

The second family is character-level obfuscation rather than encoding: carets in cmd, backticks and the format operator in PowerShell, %VAR:~n,m% substring expansion, quotes inserted mid-token, variables assembled and then invoked. Match density rather than presence. One caret is a normal escape; fifteen carets in one command line is not a command line anyone typed. Finally, execution guardrails cap what any of this can achieve: if the key is derived from the environment, you may never observe the decoded content at all, and the guardrail check is made of ordinary API calls that make a poor rule. That is an argument for keeping the file-write and image-load rules alongside the command-line ones, not for writing a rule against the guardrail.

04 · Common false positives

Intune, Configuration Manager and similar deployment platforms, which run detection and remediation scripts as -EncodedCommand by design — this is normally the single highest-volume match in the category
certutil -encode and -decode used by administrators and certificate enrolment scripts to move certificate material around as text
Monitoring, backup and inventory agents that register scheduled tasks with a base64 argument, then run them on a fixed schedule from every host in the estate
Minified and bundled JavaScript, source maps and web application build output, which trip entropy and long-string rules written against file content
Commercially packed and protected binaries — DRM wrappers, anti-cheat, licence protection — whose sections have the same entropy profile as a packer because they are one
Cloud and container CLI usage, where secrets, kubeconfigs and manifests are routinely base64 on the command line

05 · Detection maturity

Tier 1 — starting point: Matches -EncodedCommand and similar encoding flags, or a base64-shaped string, anywhere on a command line.
Tier 2 — tuned: Requires encoding together with a decode-and-execute pair or a high density of escape characters, with deployment tooling excluded by signed parent path.
Tier 3 — correlated: Reads the decoded content from script block logging or enrichment and scores on what the decoded command actually does, the parent chain, and whether the payload was written to disk or loaded in memory afterwards.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Require the pair: encoding plus a decode call plus an execution sink. A rule that fires on the encoding alone will be turned off within a week and will have taught the author that the category does not work
Exclude deployment tooling by the full signed path of the parent process, never by the encoded string — the string is the attacker's half and the parent is not
Match parameter prefixes case-insensitively and cover the dash variants: PowerShell accepts -e, -en, -enc and any longer prefix of -EncodedCommand, and Sigma's windash modifier handles the separator forms
Decode the blob during enrichment so the alert carries the plaintext — an alert that says only 'encoded command observed' hands the analyst the same work the rule was supposed to do
Use payload length as a cheap second condition; a several-thousand-character blob is a different population from a forty-character one, and the split is usually visible in a day of your own data
Where script block logging is enabled, make 4104 the primary source and keep the command-line rule as coverage for the runtimes 4104 cannot see — and account for the multi-event split when you write the match

Declared by the author

Screenshot and UI-regression helpers on build agents, which compare a captured .png against a baseline by walking it with GetPixel or LockBits from a PowerShell one-liner invoked by the pipeline — on a host that runs visual tests this is the most likely match of the three entries here.
Administrative and packaging one-liners that sample a colour out of a logo or wallpaper .png with GetPixel, for example to derive a theme or accent colour during provisioning, where the whole operation is short enough to be typed on the invocation line rather than kept in a script file.
Image-processing utilities driven from a scheduled task, such as OCR, barcode or QR pre-processing that calls LockBits on a .bmp or .png for fast pixel access and is launched with the file path as an argument.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/fed5e59a-008e-4c19-a4be-37c5480589e8

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell walking image pixels on the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it