T1027.003 — Steganography

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. Duqu was an early example of malware that used steganography. It…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.003 Obfuscated Files or Information: Steganography

title: "T1027.003 Obfuscated Files or Information: Steganography"
id: ad92aaea-4f8b-41c3-a2de-314048a7e75d
description: 'Detection Strategy for Steganographic Tooling Usage in Script Execution. Detects PowerShell invocation of known steganography tooling (e.g. Invoke-PSImage) and encoded-command execution referencing image files. NOTE: hidden data embedded in image pixel bytes is not observable via Windows/Sysmon telemetry; this rule instead detects the command-line pattern of the steganography tooling being invoked, the closest defensible Windows-observable proxy. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ParentProcessImage, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1027/003
author: Shahrukh Khan
date: 2026-02-10
license: MIT
tags:
  - attack.stealth
  - attack.t1027.003

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_psimage_tool:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Invoke-PSImage'
  selection_encoded_image_ref:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains|all:
      - '.png'
      - '-EncodedCommand'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - Security researchers/red teams testing steganography tooling; legitimate scripts combining PowerShell with .png paths and encoded commands are rare but possible.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1027.003 Obfuscated Files or Information: Steganography

title: "T1027.003 Obfuscated Files or Information: Steganography"
id: d98190af-41b6-4286-863b-0e90300bd6bf
description: 'Detection Strategy for Steganographic Abuse in File & Script Execution. Corrected logsource category to process_creation to match the EXECVE-based detection content below; it was previously declared as file_event despite the rule matching process execution records, an internal logsource/telemetry mismatch. Tune using: MonitoredToolsList, ScriptInterpreterMatch.'
references:
  - https://attack.mitre.org/techniques/T1027/003
author: Shahrukh Khan
date: 2026-02-25
license: MIT
tags:
  - attack.stealth
  - attack.t1027.003

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/steghide'
      - '/outguess'
      - '/zsteg'
  condition: selection

falsepositives:
  - Legitimate steganalysis/CTF tool use; auditd cannot verify actual hidden payload presence within a file.

level: low

T1027.003 Obfuscated Files or Information: Steganography

title: "T1027.003 Obfuscated Files or Information: Steganography"
id: f1b18457-148f-48a7-9af2-8492e9080b06
description: 'Detection Strategy for Steganographic Abuse in File & Script Execution. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: StegoToolNamePatterns, ParentScriptSources.'
references:
  - https://attack.mitre.org/techniques/T1027/003
author: Shahrukh Khan
date: 2026-05-11
license: MIT
tags:
  - attack.stealth
  - attack.t1027.003

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith:
      - '/python3'
      - '/perl'
      - '/curl'
  selection_port:
    DestinationPort:
      - 80
      - 443
  condition: selection and selection_port

falsepositives:
  - Scripted image-processing or upload utilities operating normally, since steganographic tool naming patterns are unverifiable from network_connection metadata alone.

level: low

Related sub-techniques

Explore