Cross-source coverage
T1027.003 / ATT&CK
Obfuscated Files or Information: Steganography
5 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.
Duqu was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.
By the end of 2017, a threat group used Invoke-PSImage to hide PowerShell commands in an image file (.png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.
- Tactics
- Stealth
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLmacos:osquerymacos:unifiedlog
How MITRE says to detect it DET0119
Detection Strategy for Steganographic Abuse in File & Script Execution
Windows Analytic 0331
Detects execution of image viewers or PowerShell scripts accessing or decoding files with mismatched MIME headers or embedded script-like byte patterns; often correlated with suspicious parent-child process lineage and outbound connections.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=3, 22WinEventLog:SecurityEventCode=4663, 4670, 4656
Linux Analytic 0332
Detects access to media files followed by execution of scripts (bash, Python, etc.) referencing those same files, or outbound traffic triggered shortly after file read. Correlates unusual use of tools like `steghide`, `exiftool`, or image libraries.
auditd:SYSCALLopenauditd:SYSCALLexecveauditd:SYSCALLconnect
macOS Analytic 0333
Detects manipulation of PNG, JPG, or GIF files by user-initiated scripts followed by script execution or exfiltration behavior, especially from `osascript`, `python`, or `bash`, in combination with LaunchAgent persistence or curl activity.
macos:osqueryfile_eventsmacos:osqueryprocess_eventsmacos:unifiedlognetwork connection events
SigmaHQ/sigma
5 rules| Detection | Severity | Format |
|---|---|---|
| Findstr Launching .lnk File | Medium | Sigma |
| Steganography Extract Files with Steghide | Low | Sigma |
| Steganography Hide Files with Steghide | Low | Sigma |
| Steganography Hide Zip Information in Picture File | Low | Sigma |
| Steganography Unzip Hidden Information From Picture File | Low | Sigma |