T1001.002 — Steganography

Tactic: Command and Control · Platforms: Linux, macOS, Windows, ESXi

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of…

Sub-technique of Data Obfuscation (T1001).

Sigma detection rules (4)

T1001.002 Data Obfuscation: Steganography

title: "T1001.002 Data Obfuscation: Steganography"
id: db6cc0b4-cb18-411f-af37-2fa5dcb7583e
description: 'Steganographic payloads hide data inside image/document file bytes, which Sysmon/Security telemetry cannot inspect (Sysmon logs file and network metadata, not content) -- there is no EventID that can confirm steganography occurred. As a defensible host-observable proxy, this rule surfaces two coarse, correlatable signals for analyst pivoting: (1) creation of image/media files in user-writable locations (Sysmon EventID 11) and (2) outbound network connections (Sysmon EventID 3) -- analysts should pivot on shared Image/host/time to find candidates, since this rule cannot itself enforce that correlation. Retargeted from a category/EventID mismatch (network_connection category tagged with EventID 1, a process-creation ID). Tune using: FileExtensionFilter, PayloadEntropyThreshold, ExecutionToExfilTimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1001/002
author: Shahrukh Khan
date: 2026-04-06
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.002

logsource:
  product: windows
  service: sysmon

detection:
  selection_network:
    EventID: '3'
    Initiated: 'true'

  selection_image_file_write:
    EventID: '11'
    TargetFilename|endswith:
      - '.jpg'
      - '.jpeg'
      - '.png'
      - '.bmp'
      - '.gif'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_network or selection_image_file_write) and not filter_system_account

falsepositives:
  - Extremely high volume by design -- this is a candidate-surfacing rule, not a standalone alert; nearly all normal web browsing (image writes) and network activity will match. Only actionable when correlated by Image/host/time window, or layered with content-inspection tooling (proxy/AV/DLP) that can actually examine file and network payloads.

level: low

T1001.002 Data Obfuscation: Steganography

title: "T1001.002 Data Obfuscation: Steganography"
id: deadd1dd-71e8-4307-8093-9123b82aeab1
description: 'Detects execution of steganography tooling (steghide, outguess, zsteg) as a proxy for potential steganographic C2 use. This is a single process_creation selection with no network telemetry -- it does NOT correlate file creation with subsequent network egress, so it cannot by itself distinguish steganographic C2 use from benign research, CTF, or forensic use of the same tools. Tune using: ToolNameMatch.'
references:
  - https://attack.mitre.org/techniques/T1001/002
author: Shahrukh Khan
date: 2026-06-11
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.002

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/steghide'
      - '/outguess'
      - '/zsteg'
  condition: selection

falsepositives:
  - Legitimate use of steganography tools for research, CTF exercises, or forensic analysis; execution alone does not confirm the tool was used to hide C2 traffic, and this rule does not correlate with network egress, so treat matches as a starting point for investigation rather than confirmed C2 activity.

level: medium

T1001.002 Data Obfuscation: Steganography

title: "T1001.002 Data Obfuscation: Steganography"
id: 759e2321-8f68-451a-9187-8b9edcaccf7b
description: 'Detecting Steganographic Command and Control via File + Network Correlation. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcessBaseline, TimeDelta.'
references:
  - https://attack.mitre.org/techniques/T1001/002
author: Shahrukh Khan
date: 2026-01-01
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.002

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|endswith:
      - '.png'
      - '.jpg'
      - '.gif'
      - '.bmp'
  selection_process:
    Image|endswith:
      - '/python3'
      - '/osascript'
      - '/perl'
  condition: selection and selection_process

falsepositives:
  - Standard photo editing or export activity by graphics applications, since steganographic content embedded in image files cannot be identified from filename or process metadata alone.

level: low

T1001.002 Data Obfuscation: Steganography

title: "T1001.002 Data Obfuscation: Steganography"
id: e8bddfcf-e0b6-45db-bcec-4718a5564928
description: 'Detecting Steganographic Command and Control via File + Network Correlation. (Retargeted to the file_change ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FilenamePattern, UnusualDestinationIP.'
references:
  - https://attack.mitre.org/techniques/T1001/002
author: Shahrukh Khan
date: 2026-04-19
license: MIT
tags:
  - attack.command-and-control
  - attack.t1001.002

logsource:
  category: file_change
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains: '/vmfs/volumes/'
  selection_ext:
    Message|contains:
      - '.png'
      - '.jpg'
      - '.iso'

  condition: selection and selection_ext

falsepositives:
  - Legitimate ISO or image uploads to datastores for VM installation media are common and will match this filename pattern; ESXi cannot inspect file content for hidden payloads so this is a weak proxy only.

level: low

Related sub-techniques

Explore