microsoft / AttackSurfaceAnalyzer

Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.
MIT License
2.68k stars 271 forks source link

Flag Zip files that are also jpegs #682

Open gfs opened 1 year ago

gfs commented 1 year ago

What does this rule detect?

It is possible to concatenation a zip on the end of a jpeg. It will still open and parse as a jpeg and it will also be able to be unzipped. This seems like an unusual thing that might be worth reporting on.

https://ostechnix.com/hide-files-inside-images-linux/

Why should this rule be added?

Does this require the addition of a new operation to the parser?

No.

Rule Json (optional)