MITRE ATT&CKsub-technique

T1001.002 Steganography

Published 2020-03-15 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Command And Control
Platforms
Linux, macOS, Windows, ESXi
Version
1.1
Created
2020-03-15

Description

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1001 Data Obfuscation technique

Tactic · MITRE ATT&CK (1)

  • TA0011 Command and Control tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1031 Network Intrusion Prevention mitigation

Referenced by MITRE ATT&CK · uses (13)

  • S1141 LunarWeb software (malware)
  • S1142 LunarMail software (malware)
  • C0023 Operation Ghost campaign
  • S0672 Zox software (malware)
  • S0633 Sliver software (tool)
  • S0559 SUNBURST software (malware)
  • S0495 RDAT software (malware)
  • S0395 LightNeuron software (malware)
  • S0230 ZeroT software (malware)
  • S0187 Daserf software (malware)
  • G0001 Axiom group
  • S0037 HAMMERTOSS software (malware)
  • S0038 Duqu software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-636 Hiding Malicious Data or Code within Files attack pattern

Referenced by Compliance · mitigates (8)

  • CIS-13.8 Deploy a Network Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References