A polyglot is a file that is valid in two or more formats. Polyglot files
pose a problem for malware detection systems that route files to
format-specific detectors/signatures, as well as file upload and sanitization
tools. In this work we found that existing file-format and embedded-file
detection tools, even those developed specifically for polyglot files, fail to
reliably detect polyglot files used in the wild, leaving organizations
vulnerable to attack. To address this issue, we studied the use of polyglot
files by malicious actors in the wild, finding $30$ polyglot samples and $15$
attack chains that leveraged polyglot files. In this report, we highlight two
well-known APTs whose cyber attack chains relied on polyglot files to bypass
detection mechanisms. Using knowledge from our survey of polyglot usage in the
wild -- the first of its kind -- we created a novel data set based on adversary
techniques. We then trained a machine learning detection solution, PolyConv,
using this data set. PolyConv achieves a precision-recall area-under-curve
score of $0.999$ with an F1 score of $99.20$% for polyglot detection and
$99.47$% for file-format identification, significantly outperforming all other
tools tested. We developed a content disarmament and reconstruction tool,
ImSan, that successfully sanitized $100$% of the tested image-based polyglots,
which were the most common type found via the survey. Our work provides
concrete tools and suggestions to enable defenders to better defend themselves
against polyglot files, as well as directions for future work to create more
robust file specifications and methods of disarmament.

在本研究中，我们发现现有的文件格式和嵌入式文件检测工具都不能可靠地检测出在野外使用的多格式文件，从而使组织面临攻击的风险。为了解决这个问题，我们研究了恶意攻击者在野外使用多格式文件的情况，并创建了一个新的数据集来训练机器学习检测解决方案，PolyConv。我们还开发了一个内容清除和重建工具，ImSan，有效地消毒了所有测试的基于图像的多格式文件。我们的工作为防御者提供了具体的工具和建议，以更好地抵御多格式文件，并为未来的工作提供方向，以创建更强大的文件规范和消除方法。