Cross-source coverage
T1001.002 / ATT&CK
Data Obfuscation: Steganography
3 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
- Tactics
- Command and Control
- Platforms
- Linux · macOS · Windows · ESXi
- Telemetry
-
WinEventLog:SysmonNSM:Flowauditd:SYSCALLmacos:unifiedlogmacos:osqueryesxi:vmkernelesxi:hostd
How MITRE says to detect it DET0235
Detecting Steganographic Command and Control via File + Network Correlation
Windows Analytic 0651
Detect the creation or modification of common media file formats (e.g.,.jpg,.png,.wav) following suspicious process activity like compression or encryption, especially when paired with lateral movement or exfiltration behavior.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=3, 22NSM:FlowSession Transfer Content
Linux Analytic 0652
Unusual use of steganographic or media processing binaries (e.g., `steghide`, `ffmpeg`, `imagemagick`) followed by outbound communication to external IPs with high data output and media MIME types.
auditd:SYSCALLexecveNSM:FlowCaptured File ContentNSM:FlowObserved File Transfers
macOS Analytic 0653
Abnormal usage of Preview, ImageMagick, or binary editors to alter images/documents, followed by exfiltration or outbound connections with mismatched file MIME types or payload structure.
macos:unifiedlogFile creationmacos:osqueryprocess_eventsNSM:FlowC2 exfiltration
ESXi Analytic 0654
Suspicious modification of file artifacts (e.g., logs, ISO templates) on ESXi datastores, followed by beaconing or POST operations to external IPs potentially hiding payloads in file-like traffic.
esxi:vmkernelStorage access and file opsesxi:hostdService initiated connectionsNSM:FlowTransferred file observations
socfortress/Wazuh-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Script executed from hidden payload likely appended to image (Stego + Execution) | High | Wazuh XML |
| Suspicious command used in possible steganographic payload delivery (T1001.002) | High | Wazuh XML |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| Abnormally Large JPEG Filed Downloaded from New Source | Undefined | KQL |