Bypassed enterprise DLP (Netskope) using only native Windows CMD and a PNG file — full writeup with mitigation
Source Reddit BlueTeam
Discussion
This research documents a technique to bypass Netskope enterprise DLP by embedding sensitive data three layers deep inside a PPTX file: a text file zipped, appended to a PNG image via Windows CMD binary copy, then embedded in the PPTX. Netskope's default inspection recursion depth is less than three, so it fails to detect the hidden data. The technique requires only native Windows tools and no admin rights. Detection can be improved by increasing recursion depth or using metadata anomaly rules. A coordinated detection approach using SentinelOne EDR behavioral alerts on CMD binary copy commands combined with Netskope metadata inspection is recommended. The technique applies to all Microsoft Office file formats using ZIP-based structures.
r/AskNetsec (opens in a new tab)u/kehndi-hundi_si0 points0 comments
Documented a data exfiltration technique that bypasses Netskope's default inspection by exploiting recursion depth limitations via file nesting.
The chain: secret.txt → zipped → binary appended into PNG via copy /b → embedded into PPTX. Three layers deep — beyond Netskope's default inspection threshold. No additional software needed on the source machine, no admin rights required.
Also found a low-cost detection path — anomalous metadata extensions (.txtux, .ux) surface during standard inspection without increasing recursion depth.
Full writeup with reproduction steps, binwalk forensics, and a dual-layer mitigation using SentinelOne behavioral rules + Netskope metadata rules.
https://github.com/YuvaBhargav/DLP-Bypass-Research
Happy to answer questions or get torn apart — genuinely want to know if there are gaps in the mitigation logic?