MITRE ATT&CKsub-technique

T1027.003 Steganography

Published 2020-02-05 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
2.0
Created
2020-02-05

Description

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. Duqu was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server. By the end of 2017, a threat group used Invoke-PSImage to hide PowerShell commands in an image file (.png) and execute the code on a victim's system. In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1027 Obfuscated Files or Information technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (31)

  • G1056 TeamPCP group
  • S1145 Pikabot software (malware)
  • C0023 Operation Ghost campaign
  • C0005 Operation Spalax campaign
  • G1006 Earth Lusca group
  • S0659 Diavol software (malware)
  • S0654 ProLock software (malware)
  • G0138 Andariel group
  • S0644 ObliqueRAT software (malware)
  • G0127 TA551 group
  • S0565 Raindrop software (malware)
  • S0513 LiteDuke software (malware)
  • S0511 RegDuke software (malware)
  • S0518 PolyglotDuke software (malware)
  • S0495 RDAT software (malware)
  • S0483 IcedID software (malware)
  • S0473 Avenger software (malware)
  • S0469 ABK software (malware)
  • S0470 BBK software (malware)
  • S0471 build_downer software (malware)
  • S0458 Ramsay software (malware)
  • S0439 Okrum software (malware)
  • G0099 APT-C-36 group
  • G0081 Tropic Trooper group
  • S0234 Bandook software (malware)
  • G0065 Leviathan group
  • G0067 APT37 group
  • G0069 MuddyWater group
  • S0231 Invoke-PSImage software (tool)
  • G0060 BRONZE BUTLER group
Show all 31 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-636 Hiding Malicious Data or Code within Files attack pattern

References