T1001.002 Steganography

command and control — Linux, macOS, Windows, ESXi · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1001.002

KEV CVEs mapped here

<p>Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0235 Detecting Steganographic Command and Control via File + Network Correlation v1.0
AN0651 Windows
Detect the creation or modification of common media file formats (e.g., .jpg, .png, .wav) following suspicious process activity like compression or encryption, especially when paired with lateral movement or exfiltration behavior.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Sysmon EventCode=11 → DC0039 File Creation
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
NSM:Flow Session Transfer Content → DC0085 Network Traffic Content

Tunable: FileExtensionFilter PayloadEntropyThreshold ExecutionToExfilTimeWindow

AN0652 Linux
Unusual use of steganographic or media processing binaries (e.g., steghide, ffmpeg, imagemagick) followed by outbound communication to external IPs with high data output and media MIME types.

auditd:SYSCALL execve → DC0032 Process Creation
NSM:Flow Captured File Content → DC0085 Network Traffic Content
NSM:Flow Observed File Transfers → DC0059 File Metadata

Tunable: ToolNameMatch OutboundTrafficPattern

AN0653 macOS
Abnormal usage of Preview, ImageMagick, or binary editors to alter images/documents, followed by exfiltration or outbound connections with mismatched file MIME types or payload structure.

macos:unifiedlog File creation → DC0039 File Creation
macos:osquery process_events → DC0032 Process Creation
NSM:Flow C2 exfiltration → DC0085 Network Traffic Content

Tunable: ParentProcessBaseline TimeDelta

AN0654 ESXi
Suspicious modification of file artifacts (e.g., logs, ISO templates) on ESXi datastores, followed by beaconing or POST operations to external IPs potentially hiding payloads in file-like traffic.

esxi:vmkernel Storage access and file ops → DC0059 File Metadata
esxi:hostd Service initiated connections → DC0082 Network Connection Creation
NSM:Flow Transferred file observations → DC0085 Network Traffic Content

Tunable: FilenamePattern UnusualDestinationIP

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1001.002`

No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.

T1001.002 Steganography

KEV CVEs mapped to this technique · CTID Mappings Explorer

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1001.002

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1001.002`