PowerShell walking image pixels on the command line

Siemphony@siemphonymediumT1027.003unverifiedPlaybook · Defence evasion

Matches a process creation where a PowerShell host is launched with both a media filename and a pixel-level extraction construct on the same command line, which is the observable half of AN0331 — the Invoke-PSImage shape, where a .png is opened not to display it but to reassemble script or shellcode out of its pixels. Neither term alone is worth alerting on, so both selections are required: a media extension without a pixel construct is ordinary image handling, and a decoder without a media file is generic base64 work that belongs to the obfuscation parent T1027. The construct list is deliberately narrow. `System.Drawing`, `Bitmap`, `ReadAllBytes` and `FromBase64String` were removed because branding, wallpaper, thumbnailing and installer scripts use them on media files constantly, and `certutil -decode` with them, because unwrapping a base64 asset is the parent technique rather than steganography. What is left is per-pixel access, which ordinary scripts have little reason to do. The blind spot is large and structural: Sysmon EventID 1 and Security 4688 record only what was typed on the invocation line, so the same decode logic run as `powershell -File decode.ps1 logo.png`, or wrapped in `-EncodedCommand`, puts none of these tokens on the command line and is invisible here even though PowerShell 4104 ScriptBlockText would show it in full — no PowerShell log source appears in this brief (AN0331 names Sysmon EventID 1, 3 and 22 and Security 4663/4670/4656 only), so that rebuild cannot be done without inventing a logsource. Treat this as a hunting lead for inline one-liners, not as coverage of the technique. Nothing here inspects the file either, so a genuine carrier image and a corporate logo are indistinguishable to it, and a compiled loader reading a PNG from its own resources puts nothing on a command line at all. Prerequisite: this is written in the Sysmon EventID 1 process-creation vocabulary (`Image`, `CommandLine`), and Sysmon is not present in a default Windows install; an estate with only Security 4688 needs the Image-to-NewProcessName mapping first, plus Audit Process Creation and the separate policy that includes the command line in those events. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0119, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: PowerShell walking image pixels on the command line2id: fed5e59a-008e-4c19-a4be-37c5480589e83status: experimental4description: |5  Matches a process creation where a PowerShell host is launched with both a6  media filename and a pixel-level extraction construct on the same command7  line, which is the observable half of AN0331 — the Invoke-PSImage shape, where8  a .png is opened not to display it but to reassemble script or shellcode out9  of its pixels. Neither term alone is worth alerting on, so both selections are10  required: a media extension without a pixel construct is ordinary image11  handling, and a decoder without a media file is generic base64 work that12  belongs to the obfuscation parent T1027. The construct list is deliberately13  narrow. `System.Drawing`, `Bitmap`, `ReadAllBytes` and `FromBase64String` were14  removed because branding, wallpaper, thumbnailing and installer scripts use15  them on media files constantly, and `certutil -decode` with them, because16  unwrapping a base64 asset is the parent technique rather than steganography.17  What is left is per-pixel access, which ordinary scripts have little reason to18  do. The blind spot is large and structural: Sysmon EventID 1 and Security 468819  record only what was typed on the invocation line, so the same decode logic run20  as `powershell -File decode.ps1 logo.png`, or wrapped in `-EncodedCommand`,21  puts none of these tokens on the command line and is invisible here even22  though PowerShell 4104 ScriptBlockText would show it in full — no PowerShell23  log source appears in this brief (AN0331 names Sysmon EventID 1, 3 and 22 and24  Security 4663/4670/4656 only), so that rebuild cannot be done without inventing25  a logsource. Treat this as a hunting lead for inline one-liners, not as26  coverage of the technique. Nothing here inspects the file either, so a genuine27  carrier image and a corporate logo are indistinguishable to it, and a compiled28  loader reading a PNG from its own resources puts nothing on a command line at29  all. Prerequisite: this is written in the Sysmon EventID 1 process-creation30  vocabulary (`Image`, `CommandLine`), and Sysmon is not present in a default31  Windows install; an estate with only Security 4688 needs the32  Image-to-NewProcessName mapping first, plus Audit Process Creation and the33  separate policy that includes the command line in those events.34  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0119, not hand-written and not tested by its author. Any lab result is on this rule's own page.35references:36  - https://attack.mitre.org/techniques/T1027/00337  - https://attack.mitre.org/detectionstrategies/DET011938author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)39date: 2026-08-1640tags:41  - attack.defense-evasion42  - attack.t1027.00343logsource:44  category: process_creation45  product: windows46detection:47  selection_host:48    Image|endswith:49      - '\powershell.exe'50      - '\pwsh.exe'51  selection_media_file:52    CommandLine|contains:53      - '.png'54      - '.jpg'55      - '.jpeg'56      - '.bmp'57      - '.gif'58      - '.ico'59      - '.wav'60  selection_pixel_construct:61    CommandLine|contains:62      - 'GetPixel'63      - 'LockBits'64      - 'Invoke-PSImage'65  condition: selection_host and selection_media_file and selection_pixel_construct66falsepositives:67  - "Screenshot and UI-regression helpers on build agents, which compare a captured .png against a baseline by walking it with GetPixel or LockBits from a PowerShell one-liner invoked by the pipeline — on a host that runs visual tests this is the most likely match of the three entries here."68  - "Administrative and packaging one-liners that sample a colour out of a logo or wallpaper .png with GetPixel, for example to derive a theme or accent colour during provisioning, where the whole operation is short enough to be typed on the invocation line rather than kept in a script file."69  - "Image-processing utilities driven from a scheduled task, such as OCR, barcode or QR pre-processing that calls LockBits on a .bmp or .png for fast pixel access and is launched with the file path as an argument."70level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains ".png" or ProcessCommandLine contains ".jpg" or ProcessCommandLine contains ".jpeg" or ProcessCommandLine contains ".bmp" or ProcessCommandLine contains ".gif" or ProcessCommandLine contains ".ico" or ProcessCommandLine contains ".wav")) and (ProcessCommandLine contains "GetPixel" or ProcessCommandLine contains "LockBits" or ProcessCommandLine contains "Invoke-PSImage"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*.png*" OR CommandLine="*.jpg*" OR CommandLine="*.jpeg*" OR CommandLine="*.bmp*" OR CommandLine="*.gif*" OR CommandLine="*.ico*" OR CommandLine="*.wav*")) AND (CommandLine="*GetPixel*" OR CommandLine="*LockBits*" OR CommandLine="*Invoke-PSImage*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*.png*" OR TO_LOWER(process.command_line) LIKE "*.jpg*" OR TO_LOWER(process.command_line) LIKE "*.jpeg*" OR TO_LOWER(process.command_line) LIKE "*.bmp*" OR TO_LOWER(process.command_line) LIKE "*.gif*" OR TO_LOWER(process.command_line) LIKE "*.ico*" OR TO_LOWER(process.command_line) LIKE "*.wav*")) AND (TO_LOWER(process.command_line) LIKE "*getpixel*" OR TO_LOWER(process.command_line) LIKE "*lockbits*" OR TO_LOWER(process.command_line) LIKE "*invoke-psimage*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(\.png|\.jpg|\.jpeg|\.bmp|\.gif|\.ico|\.wav)</field>    <field name="CommandLine" type="pcre2">(?i)(GetPixel|LockBits|Invoke-PSImage)</field>    <description>PowerShell walking image pixels on the command line</description>    <mitre>      <id>T1027.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: fed5e59a-008e-4c19-a4be-37c5480589e8

ATT&CKT1027.003

T1027.003Steganography

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.003, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add more specific conditions to filter out known benign software, such as excluding events where the CommandLine contains specific strings known to be used by legitimate tools
Increase the specificity of the selection_media_file by looking for more specific file extensions or paths that are commonly used by attackers
Consider adding a threshold for the number of events within a certain time frame to reduce noise from legitimate tools that may trigger the rule occasionally

Declared by the author

Screenshot and UI-regression helpers on build agents, which compare a captured .png against a baseline by walking it with GetPixel or LockBits from a PowerShell one-liner invoked by the pipeline — on a host that runs visual tests this is the most likely match of the three entries here.
Administrative and packaging one-liners that sample a colour out of a logo or wallpaper .png with GetPixel, for example to derive a theme or accent colour during provisioning, where the whole operation is short enough to be typed on the invocation line rather than kept in a script file.
Image-processing utilities driven from a scheduled task, such as OCR, barcode or QR pre-processing that calls LockBits on a .bmp or .png for fast pixel access and is launched with the file path as an argument.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects the use of PowerShell to walk image pixels on the command line, which is a technique often used to hide obfuscated payloads. The rule identifies this behavior by looking for the execution of PowerShell with command lines that contain references to image files and pixel manipulation functions, distinguishing it from normal PowerShell usage.

02 · Telemetry you need

Log source: process creation events
Specific fields: Image, CommandLine
Audit setting: Process creation events must be audited, which may be off by default in some Windows configurations

03 · How the logic works

The rule works by selecting process creation events where the image is either powershell.exe or pwsh.exe, and the command line contains references to media files (such as .png, .jpg, etc.) and pixel manipulation functions (such as GetPixel, LockBits, or Invoke-PSImage). The condition requires all three selections to be true, meaning the event must involve PowerShell, reference a media file, and include a pixel manipulation function.

04 · Common false positives

Graphic design or digital art software that uses PowerShell scripts to automate tasks involving image manipulation
Legitimate scripting tools that use Invoke-PSImage for non-malicious purposes, such as generating images for reports or presentations
Automated testing frameworks that use PowerShell to test image processing functionality

05 · Detection maturity

tier_1: This rule as written may generate a significant amount of noise and requires careful tuning to be effective.
tier_2: With proper tuning, such as adding exclusions for known benign software and increasing the specificity of the media file selection, this rule can become more reliable and useful for detecting obfuscated payloads.
tier_3: Correlating this rule with other signals, such as network traffic or API calls related to suspicious domains or IPs, can further increase its effectiveness in detecting and responding to attacks that use obfuscated payloads.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/fed5e59a-008e-4c19-a4be-37c5480589e8

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell walking image pixels on the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it