Invoke-PSImage takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords. [1]

ID: S0231
Type: TOOL
Version: 1.1
Created: 18 April 2018
Last Modified: 18 October 2022

Techniques Used

Domain ID Name Use
Enterprise T1027 .003 Obfuscated Files or Information: Steganography

Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.[1]

.009 Obfuscated Files or Information: Embedded Payloads

Invoke-PSImage can be used to embed payload data within a new image file.[2]

Groups That Use This Software

ID Name References
G0034 Sandworm Team